- Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream version. - Update spec file and resolve a build issue (BZ 2113091). - Switch to SPDX licensing. - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Some more static analysis fixes (RHEL-38991) - Add patches for a couple of bugs that make static analysis unhappy (RHEL-38991) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.22.0 - Rebuilt for RHBZ#2226577 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.20.6 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fix CVE-2026-41651 - Related: RHEL-39682 (Backport upstream patches to fix recent regressions) - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Resolves: RHEL-39682 (Mark PackageKit as compulsory in AppStream metadata) - Update to 3.2.4 - Add fix for building against PipeWire 1.3.x Resolves: RHEL-77078 Initial commit on c10s Resolves: RHEL-77078 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.0 - Related: RHEL-122178 - install BATS if it's not available - Related: RHEL-80817 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.16.0 - Related: RHEL-80817 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.15.0 - Related: RHEL-80817 - fix dep issues in tests subpackage - Resolves: RHEL-80817 - rebuilt to try TMT tests in osci - Resolves: RHEL-80817 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.14.0 - Related: RHEL-58990 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.13.1 - Related: RHEL-58990 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.13.0 - Resolves: RHEL-65320 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.1 - Resolves: RHEL-170143 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.0 - Related: RHEL-122178 - install BATS if it's not available - Related: RHEL-80817 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.16.0 - Related: RHEL-80817 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.15.0 - Related: RHEL-80817 - fix dep issues in tests subpackage - Resolves: RHEL-80817 - rebuilt to try TMT tests in osci - Resolves: RHEL-80817 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.14.0 - Related: RHEL-58990 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.13.1 - Related: RHEL-58990 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.13.0 - Resolves: RHEL-65320 - Update to current stable. Resolves: RHEL-38576 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to 4.1.8 release. Resolves: RHEL-40014 - Bump release for June 2024 mass rebuild - Fix issue with dsa_user_test_runner device clean up. Resolves: RHEL-32469 - Rebase to 4.1.6 release Resolves: RHEL-29909 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to v4.1.1 release - Update to v4.1 release - Fix issue with restoring SELinux file label - Use selinux_requires_min to avoid policycoreutils-python-utils dependency Resolves: RHEL-78631 - Rebase to latest upstream version Resolves: RHEL-2518 Resolves: RHEL-5044 Resolves: RHEL-5050 Resolves: RHEL-16141 Resolves: RHEL-44580 Resolves: RHEL-56353 Resolves: RHEL-78631 Resolves: RHEL-73686 - Fixes for RHEL SAST Automation Resolves: RHEL-45146 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for June 2024 mass rebuild - Fix a typo in the License expression - Fix build not respecting distribution compiler flags; this means executables are now PIE, and the debuginfo package is now useful - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rebase to version 20230622 (#2216272) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebase to version 20230118 (#2162105) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Make package noarch - Add rsadgstsign support - Only install rpm-sign on s390x and ppc64le - Initial package - Initial release for AlmaLinux 10 - Update to v2025.12.2 - Update to v2025.05.1 - Update to v2025.05 - fix the pretrans script for symlink swap (sof-ace-tplg <-> sof-ipc4-tplg) - Add sof-ipc4-lib directory - Update to v2024.09.2 - Update to v2024.09.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to v2024.09 - Remove AVS topology files (moved to linux-firmware) - fix control API remap issue - update to alsa-lib 1.2.15.3 and alsa-ucm-conf 1.2.15.3 - update to alsa-lib 1.2.14 and alsa-ucm-conf 1.2.14 - update to alsa-lib 1.2.13 and alsa-ucm-conf 1.2.13 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - update to alsa-lib 1.2.12 and alsa-ucm-conf 1.2.12 * Updated to 1.2.15.2 * Updated to 1.2.14 * Updated to 1.2.13 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 * Updated to 1.2.12 - Bump release for June 2024 mass rebuild * Updated to 1.2.11 * Updated to 1.2.15.2 * Updated to 1.2.14 * Updated to 1.2.13 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 * Updated to 1.2.12 - Bump release for June 2024 mass rebuild * Updated to 1.2.11 - Bump the Epoch to preserve upgrade path with previous versions of RHEL - Bump release for June 2024 mass rebuild - Update to 2.16.3. Fixes rhbz#2261507. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Mitigate CVE-2024-0690. - Update to 2.16.2. Fixes rhbz#2254093. - Update to 2.16.1. Fixes rhbz#2252860. - Update to 2.16.0. Fixes rhbz#2248187. - Update to 2.16.0~rc1. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Add ExclusiveArch field - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Unretire package; update to version 9. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - new upstream release https://github.com/praiskup/argparse-manpage/releases/tag/v4.4 - new upstream release: https://github.com/praiskup/argparse-manpage/releases/tag/v4.4 - license tag in SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - new upstream release, tomli dep instead of toml https://github.com/praiskup/argparse-manpage/releases/tag/v4.3 - new upstream release, upport for pyproject.toml specs, and --manfile option - new `--include` feature, inspired by `help2man --include` - allow overriding build date with SOURCE_DATE_EPOCH environment variable - the AUTHORS section was changed to more standard AUTHOR - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml file - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - fix SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - fix invalid escape sequence (#2220936) - Rebuilt for Python 3.12 - Fix build with pip 23.1.2+ - Fixes: rhbz#2209018 - Remove usage of OpenSSL Engine - Update to 1.30.2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Upload updated source - Update to 1.28.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Update to 1.28.0 and cleanup the .spec - Update to 1.28.0 - Sort BuildRequires alphabetically - Switch to %%autosetup - Bump release for June 2024 mass rebuild - Update to 2.28.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.28.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to 2.28.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.28.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to 2.28.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.28.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fix: fails to parse /etc/fstab when there is a double comma after character resolves: RHEL-77279 - Fix: fails to parse /etc/iproute2/README and /usr/share/iproute2/ resolves: RHEL-113748 - Synchronize spec file with Fedora - lenses/tmpfiles.aug: Permit '$' character in /usr/lib/tmpfiles.d/*.conf resolves: RHEL-76283 - lenses/multipath.aug: Support all possible values for find_multipaths - lenses/systemd.aug: Allow "+"(fullprivileges) command flag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide version resolves: RHEL-55741 - Fix parsing of /etc/fstab resolves: RHEL-55741 - New upstream version 1.14.1 - Use github tarballs again. - New binary augprint. - New bash-completions subpackage. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix: fails to parse /etc/fstab when there is a double comma after character resolves: RHEL-77279 - Fix: fails to parse /etc/iproute2/README and /usr/share/iproute2/ resolves: RHEL-113748 - Synchronize spec file with Fedora - lenses/tmpfiles.aug: Permit '$' character in /usr/lib/tmpfiles.d/*.conf resolves: RHEL-76283 - lenses/multipath.aug: Support all possible values for find_multipaths - lenses/systemd.aug: Allow "+"(fullprivileges) command flag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide version resolves: RHEL-55741 - Fix parsing of /etc/fstab resolves: RHEL-55741 - New upstream version 1.14.1 - Use github tarballs again. - New binary augprint. - New bash-completions subpackage. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - myhostname is put after dns module in nsswitch.conf hosts to fix hostname --fqdn (RHEL-39537) - Bump release for June 2024 mass rebuild - Fix altfiles rendering on OSTree variants - Add back with-files-access-provider - Remove outdated scriptlets - Group merging added to nsswitch.conf group in all profiles - myhostname is put right before dns module in nsswitch.conf hosts (rhbz#2257197) - Internal packaging changes - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 1.5.0 - "minimal" profile was removed and replaced with "local". (rhbz#2253180) - "local" profile is now default (rhbz#2253180) - Rebase to 1.4.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update license expression. - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - New upstream release - Drop patches merged upstream - Add builddep on python3-setuptools for Python 3.12+ - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.1.106 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - move to SPDX license format - Update to 0.1.102 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix FTBFS in F37 (#2113117) - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.1.106 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - move to SPDX license format - Update to 0.1.102 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix FTBFS in F37 (#2113117) - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.1.106 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - move to SPDX license format - Update to 0.1.102 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix FTBFS in F37 (#2113117) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix issues identified by OpenScanHub Resolves: RHEL-44649 - Bump release for June 2024 mass rebuild - Update patch for audit logs Resolves: RHEL-22619 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to bash-5.2 patchlevel 26 Resolves: #2259619 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix another C compatibility issue in the configure script - Update to bash-5.2 patchlevel 21 Resolves: #2248970 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream version Resolves: #2216578 - Update to latest upstream version Resolves: #2208916 - Update to latest upstream version Resolves: #2196018 - Update to latest upstream version Resolves: #2189733 - improved performance and memory consumption of the fingerprint feature - rlImport: upwards traversal start in the current directory - rlImport: support '.' to import lib.sh from the current directory - rlImport: can handle libraries required by the fmf_id in different forms than (url, name) also name-only. Also the path attribute is considered - fingerprint: an asserts fingerprint and phases fingerprint is computed it is printed as a message and it is also available in the TestResults file - fixed a check for os-release file existence - fixed LOG_LEVEL usage - removed dependency on selinuxenabled - fixed a few typos, thanks to jwakely@fedoraproject.org - cleanup rlRun_LOG files at rlJournalEnd - close journal in rlDie - generate journal.xml at that moment - implemented functions rlIsOS, rlIsOSLike, rlIsOSVersion, and rlIsRHELLike - rlAssertRequired can now handle versioned dependencies - new functions rlCheckRerquired, rlCheckRecommended, and rlCheckDependencies - rlCheckRequirements is now able to check also versions requirements - fixed rlServiceDisable if called without rlServiceEnable beforehand - few internal fixes - rebased yash to version 1.2, fixes the backtick iterpretation - docs fixes, by Štěpán Němec <snemec@redhat.com> - rlImport --all imports only required libraries, not recommend - implemented chkconfig fallback to systemctl - fixed `make test` test suite execution - TestResults state indicator - profiling code - rebased yash to 1.1 - fixed rlAssertLesser - fixed failed library load name logging - ability to parse fmf id references - ability the use simpler library name - library(foo), {url: '../foo.git', name: '/'}, meaming the library is n the root folder - ability put library even deeper in the tree - library(foo/path/to/the/library), {url: '../foo.git', name: '/path/to/the/library'} - rebased yash to 1.0 - and few more minor fixes - Rebase to the laster upstream - better and more consistent search for libraries - ability to parse yaml files including main.fmf and metadata.yaml - improved performance and memory consumption of the fingerprint feature - rlImport: upwards traversal start in the current directory - rlImport: support '.' to import lib.sh from the current directory - rlImport: can handle libraries required by the fmf_id in different forms than (url, name) also name-only. Also the path attribute is considered - fingerprint: an asserts fingerprint and phases fingerprint is computed it is printed as a message and it is also available in the TestResults file - fixed a check for os-release file existence - fixed LOG_LEVEL usage - removed dependency on selinuxenabled - fixed a few typos, thanks to jwakely@fedoraproject.org - cleanup rlRun_LOG files at rlJournalEnd - close journal in rlDie - generate journal.xml at that moment - implemented functions rlIsOS, rlIsOSLike, rlIsOSVersion, and rlIsRHELLike - rlAssertRequired can now handle versioned dependencies - new functions rlCheckRerquired, rlCheckRecommended, and rlCheckDependencies - rlCheckRequirements is now able to check also versions requirements - fixed rlServiceDisable if called without rlServiceEnable beforehand - few internal fixes - rebased yash to version 1.2, fixes the backtick iterpretation - docs fixes, by Štěpán Němec <snemec@redhat.com> - rlImport --all imports only required libraries, not recommend - implemented chkconfig fallback to systemctl - fixed `make test` test suite execution - TestResults state indicator - profiling code - rebased yash to 1.1 - fixed rlAssertLesser - fixed failed library load name logging - ability to parse fmf id references - ability the use simpler library name - library(foo), {url: '../foo.git', name: '/'}, meaming the library is n the root folder - ability put library even deeper in the tree - library(foo/path/to/the/library), {url: '../foo.git', name: '/path/to/the/library'} - rebased yash to 1.0 - and few more minor fixes - Rebase to the laster upstream - better and more consistent search for libraries - ability to parse yaml files including main.fmf and metadata.yaml - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update changed b.root-servers.net address in hints (#2253460) - Update to 9.18.21 (#2255407) - Update to 9.18.20 (#2249835) - Update to 9.18.19 (#2232346) - Skip failing rbtdb_test unit test on i686 (#2240253) - Update to 9.18.18 (#2232346) - Update to 9.18.17 (#2223913) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update changed b.root-servers.net address in hints (#2253460) - Update to 9.18.21 (#2255407) - Update to 9.18.20 (#2249835) - Update to 9.18.19 (#2232346) - Skip failing rbtdb_test unit test on i686 (#2240253) - Update to 9.18.18 (#2232346) - Update to 9.18.17 (#2223913) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update changed b.root-servers.net address in hints (#2253460) - Update to 9.18.21 (#2255407) - Update to 9.18.20 (#2249835) - Update to 9.18.19 (#2232346) - Skip failing rbtdb_test unit test on i686 (#2240253) - Update to 9.18.18 (#2232346) - Update to 9.18.17 (#2223913) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update changed b.root-servers.net address in hints (#2253460) - Update to 9.18.21 (#2255407) - Update to 9.18.20 (#2249835) - Update to 9.18.19 (#2232346) - Skip failing rbtdb_test unit test on i686 (#2240253) - Update to 9.18.18 (#2232346) - Update to 9.18.17 (#2223913) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update changed b.root-servers.net address in hints (#2253460) - Update to 9.18.21 (#2255407) - Update to 9.18.20 (#2249835) - Update to 9.18.19 (#2232346) - Skip failing rbtdb_test unit test on i686 (#2240253) - Update to 9.18.18 (#2232346) - Update to 9.18.17 (#2223913) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update changed b.root-servers.net address in hints (#2253460) - Update to 9.18.21 (#2255407) - Update to 9.18.20 (#2249835) - Update to 9.18.19 (#2232346) - Skip failing rbtdb_test unit test on i686 (#2240253) - Update to 9.18.18 (#2232346) - Update to 9.18.17 (#2223913) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update changed b.root-servers.net address in hints (#2253460) - Update to 9.18.21 (#2255407) - Update to 9.18.20 (#2249835) - Update to 9.18.19 (#2232346) - Skip failing rbtdb_test unit test on i686 (#2240253) - Update to 9.18.18 (#2232346) - Update to 9.18.17 (#2223913) - Add explicit requires to the devel subpackages - Resolves: RHEL-60890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rename isnan.3 to lapack-isnan.3 to avoid conflict with man-pages package - update to 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - apply upstream fix to https://github.com/Reference-LAPACK/lapack/issues/763 - Adapt license tag to SPDX - Update to 5.85 Resolves: RHEL-142551 - Fix problem with menu handling Resolves: RHEL-103965 - Update to 5.83 - Resolves: RHEL-94817 - Fix startup warnings - Resolves: RHEL-88703 - Add OSCI tests - Resolves: RHEL-77171 - Fix config not being applied - Resolves: RHEL-78405 - Fix wordexp() related crasher - Resolves: RHEL-56021 - Update gating and rpminspect files - Related: Jira:RHEL-76183 - Related: Jira:RHEL-54482 - Update to 5.85 Resolves: RHEL-142551 - Fix problem with menu handling Resolves: RHEL-103965 - Update to 5.83 - Resolves: RHEL-94817 - Fix startup warnings - Resolves: RHEL-88703 - Add OSCI tests - Resolves: RHEL-77171 - Fix config not being applied - Resolves: RHEL-78405 - Fix wordexp() related crasher - Resolves: RHEL-56021 - Update gating and rpminspect files - Related: Jira:RHEL-76183 - Related: Jira:RHEL-54482 - Update to the upstream version 0.9.10 - Migrate to tmt test - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - A new NHI for REMBRANDT. - systemd configuration improvement. - Resolve: RHEL-34699 - Update to upstream release 0.9.7 - Support 'nopcie' security level - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - update to 2.1.0 - https://github.com/pkgconf/pkgconf/blob/pkgconf-2.1.0/NEWS - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update pkgconf to 1.9.5 (#2192963) - Rebuild for ATF soname bump - Rebase to 1.9.4 - Drop dependency on system-rpm-config (#2172406) - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Dropped ucs-miscfixed-fonts requirement, xorg-x11-fonts-misc is enough Resolves: RHEL-46310 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Added SPDX licenses found by ScanCode - Dropped redundant license tags from subpackages - Migrate group creation to sysusers - Bump release and rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Dropped ucs-miscfixed-fonts requirement, xorg-x11-fonts-misc is enough Resolves: RHEL-46310 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Added SPDX licenses found by ScanCode - Dropped redundant license tags from subpackages - Migrate group creation to sysusers - Bump release and rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Rebase to version 3.7.7 - Fixing SAST issues, accepted by upstream - Resolves: RHEL-39391 RHEL-67895 - Related: CVE-2026-16517 and CVE-2026-15028 - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Rebase to version 3.7.7 - Fixing SAST issues, accepted by upstream - Resolves: RHEL-39391 RHEL-67895 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix CVE-2024-48957 - Resolves: RHEL-62015 - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Rebase to version 3.7.7 - Fixing SAST issues, accepted by upstream - Resolves: RHEL-39391 RHEL-67895 - Related: CVE-2026-16517 and CVE-2026-15028 - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Rebase to version 3.7.7 - Fixing SAST issues, accepted by upstream - Resolves: RHEL-39391 RHEL-67895 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix CVE-2024-48957 - Resolves: RHEL-62015 - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Rebase to version 3.7.7 - Fixing SAST issues, accepted by upstream - Resolves: RHEL-39391 RHEL-67895 - Related: CVE-2026-16517 and CVE-2026-15028 - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Resolves: CVE-2026-4424 - Release bump for typo in dist - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Fix for CVE-2024-57970 - Resolves: RHEL-79877 - Rebase to version 3.7.7 - Fixing SAST issues, accepted by upstream - Resolves: RHEL-39391 RHEL-67895 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix CVE-2024-48957 - Resolves: RHEL-62015 - new version - new version - new version - new version - new version - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - new version - Bump release for June 2024 mass rebuild - Bump release for updated gating tests Related: RHEL-70753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for test run. - Bump release. - Really rebuild with java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Build with Java 17 - Bump release for updated gating tests Related: RHEL-70753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for test run. - Bump release. - Really rebuild with java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Build with Java 17 - Revert the changes from 1.0.8-23 Resolves: RHEL-71750 - Fix an off by one error in bzip2recover.c Resolves: RHEL-36503 - Fix out of bounds write in bz_decompress Resolves: CVE-2019-12900 - Minor spec cleanup - Add explicit requires for the bzip2 package Resolves: RHEL-69797 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild with enabled gating Resolves: RHEL-52100 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - gpgverify source tarball - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.14.5 (close RHBZ#2240942) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use new (rpm 4.17.1+) bcond style - Removed superfluous processing of the OpenPGP key. - Revert "Work around missing dependency on texlive-wasy" - Work around missing dependency on texlive-wasy - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.14.5 (close RHBZ#2240942) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use new (rpm 4.17.1+) bcond style - Removed superfluous processing of the OpenPGP key. - Revert "Work around missing dependency on texlive-wasy" - Work around missing dependency on texlive-wasy - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.14.5 (close RHBZ#2240942) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use new (rpm 4.17.1+) bcond style - Removed superfluous processing of the OpenPGP key. - Revert "Work around missing dependency on texlive-wasy" - Work around missing dependency on texlive-wasy - Bump release for June 2024 mass rebuild - Add manpages for pam_cap and capability.conf (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>) - Fix incompatibility of the build with go 1.22 (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>) - Reenable PIE in the captree tool (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>) - Use sbindir location provided by rpm (by Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>) - Include hardening flags by setting CGO_CFLAGS=CFLAGS and CGO_LDFLAGS=LDFLAGS - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.69 (with contribs from Yanko Kaneti <yaneti@declera.com>, and Andrew G. Morgan <morgan@kernel.org>) - Update license to SPDX (by Anderson Toshiyuki Sasaki <ansasaki@redhat.com>) - Make file lists more explicit to avoid accidental ABI changes (Dominik Mierzejewski <dominik@greysector.net>) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Drop unnecessary conflict with catch-devel - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Switch to SPDX license string. - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Remove the CC-BY-NC index.html file from the tarball (#2290306) - Remove the CC-BY-NC website from the tarball (#2290306) - Fix check-devel for cmake users (rhbz#2161231) - Simplify conditional logic for mingw - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update deprecated %patch macro usage - Add optional Fedora mingw packages. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix flatpak build - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - BR on libxml2 - Update to 3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - resolves: RHEL-146310 - Enable debug logs in cifs.upcall - resolves: RHEL-131409 - fix regression with cifscreds(1) - resolves: RHEL-82681 - Update to version 7.2 - Bump release for October 2024 mass rebuild: - resolves: RHEL-61731 - Update to version 7.1 - Bump release for June 2024 mass rebuild - resolves: RHEL-192935 - fix krb5 mount regression - Update to version 7.6 - resolves: RHEL-185756 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego - resolves: RHEL-146310 - Enable debug logs in cifs.upcall - resolves: RHEL-131409 - fix regression with cifscreds(1) - resolves: RHEL-82681 - Update to version 7.2 - Bump release for October 2024 mass rebuild: - resolves: RHEL-61731 - Update to version 7.1 - resolves: RHEL-247581 - fix krb5 regression with --trust-dns - resolves: RHEL-192935 - fix krb5 mount regression - Update to version 7.6 - resolves: RHEL-185756 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego - resolves: RHEL-146310 - Enable debug logs in cifs.upcall - resolves: RHEL-131409 - fix regression with cifscreds(1) - resolves: RHEL-82681 - Update to version 7.2 - Bump release for October 2024 mass rebuild: - resolves: RHEL-61731 - Update to version 7.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to CIM Schema 2.54.1, including experimental classes - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use x86_64-redhat-linux as default gcc triple for x86_64_v2 - Update to LLVM 18.1.8 (RHEL-28056) - Remove llvm17 compat package (RHEL-30890) - Enable pie (RHEL-33489) - Bump release for June 2024 mass rebuild - Rebuild LLVM 18.1.2 (RHEL-27724) - Update to LLVM 18.1.2 (RHEL-27724) - 18.1.2 Release - 18.1.1 Release - Remove some LTO workarounds - Fix gcc triple on i686 - 18.0.1-rc4 Release - RPMAUTOSPEC: unresolvable merge - Bump to release-46 - Bump release for October 2024 mass rebuild: - Fix a forbidden code point, 0x202E - RPMAUTOSPEC: unresolvable merge - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - cu-Drop-obsolete-gdisk-soft-dependency.patch [RHEL-36095] - Resolves: RHEL-36095 (Remove cloud-utils-growpart dependency on obsolete gdisk) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - cu-Drop-obsolete-gdisk-soft-dependency.patch [RHEL-36095] - Resolves: RHEL-36095 (Remove cloud-utils-growpart dependency on obsolete gdisk) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - cu-Drop-obsolete-gdisk-soft-dependency.patch [RHEL-36095] - Resolves: RHEL-36095 (Remove cloud-utils-growpart dependency on obsolete gdisk) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - cu-Drop-obsolete-gdisk-soft-dependency.patch [RHEL-36095] - Resolves: RHEL-36095 (Remove cloud-utils-growpart dependency on obsolete gdisk) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - cu-Drop-obsolete-gdisk-soft-dependency.patch [RHEL-36095] - Resolves: RHEL-36095 (Remove cloud-utils-growpart dependency on obsolete gdisk) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - cu-Drop-obsolete-gdisk-soft-dependency.patch [RHEL-36095] - Resolves: RHEL-36095 (Remove cloud-utils-growpart dependency on obsolete gdisk) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - cu-Drop-obsolete-gdisk-soft-dependency.patch [RHEL-36095] - Resolves: RHEL-36095 (Remove cloud-utils-growpart dependency on obsolete gdisk) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 1.1.7 * Update ignore list for source tarball generation * Added new assert macros to compare 2 double given an epsilon * Added meson build system * Added header with version to TAP13 output * Fixed issues with MSVC * Fixed TAP output for skipped tests * Fixed issue with fail_msg * CMake generated configs for find_package(cmocka) * Documentation improvements - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Backport a patch to fix ProtectSystem=strict - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Fix mass-rebuild failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Provide a sysusers.d file to get user() and group() provides - Rebuild for glib2 symbol export fix (#2232723) - Bump release for October 2024 mass rebuild: - Add gating.yaml via API - Bump release for June 2024 mass rebuild - New upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Backport a patch to fix ProtectSystem=strict - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Fix mass-rebuild failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Provide a sysusers.d file to get user() and group() provides - Rebuild for glib2 symbol export fix (#2232723) - add Provides: golang(github.com/russross/blackfriday/v2) - Resolves: RHEL-86199 - re-add -devel and compat - Resolves: RHEL-65351 - don't build devel and compat packages - Resolves: RHEL-65307 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Bump release for June 2024 mass rebuild - Update to latest upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream version Resolves: #2216578 - Update to latest upstream version Resolves: #2208916 - Update to latest upstream version Resolves: #2196018 - Update to latest upstream version Resolves: #2189733 - Fix typo in the Summary - Resolves: RHEL-122178 - amend dependencies for RHEL10 - Resolves: RHEL-92028 - build for RHEL10 - Resolves: RHEL-92028 - rebuild with updated dependencies: [python-]podman 4.8.0, buildah 1.33.2, skopeo 1.14.0, aardvark-dns and netavark 1.9.0 - Related: Jira:RHEL-2112 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-123651 - Resolves: RHEL-122739 - New upstream release (RHEL-123651) - Support for running corosync-qnetd-tool and corosync-qdevice-tool as a non-root user (RHEL-122739) - Resolves: RHEL-80063 - Add support for sysusers.d functionality (RHEL-80063) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - tests: Remove unused remnants of Beaker - tests: Fix TMT dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport patch to run tests in deterministic order - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - tests: Fix fmf plan deprecated attributes - Update to 4.2 - Update to 4.1 - Fix VDSO compile error on s390x - Adapt patches to patches merged upstream - Fix running on aarch64 - Switch network locking backend default to nftables - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix test setup - Add riscv64 to ExclusiveArch - Handle rseq in generic compel code (checkpoint-restore/criu#3097) - Update to 4.2 - Update to 4.1 - Fix VDSO compile error on s390x - Adapt patches to patches merged upstream - Fix running on aarch64 - Switch network locking backend default to nftables - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add bison to BuildRequires for RISC-V - Disable LTO for RISC-V - Disable testsuite for RISC-V - Run linker tests for cross binutils. Compare the native and cross results. (RHEL-117111) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-142279) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-132254) - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-126877) - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-125205) - Remove workaround for CVE-2025-5702. (RHEL-100159) - Add fix for CVE-2025-5244. (RHEL-100417) - USe correct fix for CVE-2025-5702. (RHEL-100159) - Add basic support for RISC-V 64-bit EFI objects. (RHEL-88815) - Adds z17 as a cpu name for the s390x architecture. (RHEL-87215) - Add bison to BuildRequires for RISC-V - Disable LTO for RISC-V - Disable testsuite for RISC-V - Run linker tests for cross binutils. Compare the native and cross results. (RHEL-117111) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-142279) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-132254) - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-126877) - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-125205) - Remove workaround for CVE-2025-5702. (RHEL-100159) - Add fix for CVE-2025-5244. (RHEL-100417) - USe correct fix for CVE-2025-5702. (RHEL-100159) - Add basic support for RISC-V 64-bit EFI objects. (RHEL-88815) - Adds z17 as a cpu name for the s390x architecture. (RHEL-87215) - Add bison to BuildRequires for RISC-V - Disable LTO for RISC-V - Disable testsuite for RISC-V - Run linker tests for cross binutils. Compare the native and cross results. (RHEL-117111) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-142279) - Fix a potential illegal memory access when copying a corrupt input file. (RHEL-132254) - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-126877) - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-125205) - Remove workaround for CVE-2025-5702. (RHEL-100159) - Add fix for CVE-2025-5244. (RHEL-100417) - USe correct fix for CVE-2025-5702. (RHEL-100159) - Add basic support for RISC-V 64-bit EFI objects. (RHEL-88815) - Adds z17 as a cpu name for the s390x architecture. (RHEL-87215) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - crun-1.16.1-1.el10 - update to https://github.com/containers/crun/releases/tag/1.16.1 - Related: RHEL-34195 - crun-1.16-1.el10 - update to https://github.com/containers/crun/releases/tag/1.16 - Related: RHEL-34195 - Bump release for June 2024 mass rebuild - link crun with embedded yajl statically in RHEL10 Resolves: RHEL-35583 - add gating.yaml Related: RHELMISC-3908 - Update to 1.15 upstream release - crun-1.14.4-1.el10 - update to https://github.com/containers/crun/releases/tag/1.14.4 - Resolves: RHEL-34649 RHEL-30621 - wasmedge not in RHEL, or ELN - [packit] 1.14.1 upstream release - [packit] 1.14 upstream release - crun-1.16.1-1.el10 - update to https://github.com/containers/crun/releases/tag/1.16.1 - Related: RHEL-34195 - crun-1.16-1.el10 - update to https://github.com/containers/crun/releases/tag/1.16 - Related: RHEL-34195 - Bump release for June 2024 mass rebuild - link crun with embedded yajl statically in RHEL10 Resolves: RHEL-35583 - add gating.yaml Related: RHELMISC-3908 - Update to 1.15 upstream release - crun-1.14.4-1.el10 - update to https://github.com/containers/crun/releases/tag/1.14.4 - Resolves: RHEL-34649 RHEL-30621 - wasmedge not in RHEL, or ELN - [packit] 1.14.1 upstream release - [packit] 1.14 upstream release - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix explicit package version requirement (RHEL-45635). - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Create directory structure under /var using tmpfiles.d - Remove sscg option --package from cyrus-imapd-init.service - Update location of fmf plans - update the default cyrus.conf to enable idled Resolves: RHEL-61130 - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Bump release for June 2024 mass rebuild - Update of fmf plans and gating for c10s - Cassandane: do not depend on imaptest, clean up BuildRequires - Re-enable LTO - Fix CVE-2024-34055 - Fix wrong symlinks to imtest utilities - Convert to %autorelease and %autochangelog - Create directory structure under /var using tmpfiles.d - Remove sscg option --package from cyrus-imapd-init.service - Update location of fmf plans - update the default cyrus.conf to enable idled Resolves: RHEL-61130 - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Bump release for June 2024 mass rebuild - Update of fmf plans and gating for c10s - Cassandane: do not depend on imaptest, clean up BuildRequires - Re-enable LTO - Fix CVE-2024-34055 - Fix wrong symlinks to imtest utilities - Convert to %autorelease and %autochangelog - Create directory structure under /var using tmpfiles.d - Remove sscg option --package from cyrus-imapd-init.service - Update location of fmf plans - update the default cyrus.conf to enable idled Resolves: RHEL-61130 - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Bump release for June 2024 mass rebuild - Update of fmf plans and gating for c10s - Cassandane: do not depend on imaptest, clean up BuildRequires - Re-enable LTO - Fix CVE-2024-34055 - Fix wrong symlinks to imtest utilities - Convert to %autorelease and %autochangelog - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.14.10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.14.8 - Update to 1.14.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX. - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX. - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX. - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - update to 1.3-20240101 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.3-20231002 - convert license tag to SPDX - package pkgconfig file - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - update to recent upstream version - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - new upstream version - update to recent upstream version - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - new upstream version - update to recent upstream version - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - new upstream version - Release 1.2.0 - Release 1.1.2 - Initial build - Release 1.0.2 - Fix /var/run selinux rules - Release 1.0.1 - Rebuilt for Python 3.13 - Release 1.0.0 - Release 0.0.6 - Release 0.0.5 - Release 1.2.0 - Release 1.1.2 - Initial build - Release 1.0.2 - Fix /var/run selinux rules - Release 1.0.1 - Rebuilt for Python 3.13 - Release 1.0.0 - Release 0.0.6 - Release 0.0.5 - Update DNSSEC trust anchors with 2024 key (38696) (RHEL-249229) - Prevent overflow in extract_name function (CVE-2026-2291) - Prevent DoS in DNSSEC validation (CVE-2026-4890) - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892) - Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893) - Prevent out-of-bounds read in extract_addresses (CVE-2026-5172) - Prevent heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) - Added installation of tmpfiles.d config Resolves: RHEL-122843 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Prevent overflow in extract_name function (CVE-2026-2291) - Prevent DoS in DNSSEC validation (CVE-2026-4890) - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892) - Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893) - Prevent out-of-bounds read in extract_addresses (CVE-2026-5172) - Prevent heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) - Added installation of tmpfiles.d config Resolves: RHEL-122843 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update SPDX in license tag to use uppercase conjunction - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove binary JAR files and replace them with available dependencies - Related: RHEL-37894 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update doxygen2man for latest libXML2 - include parser.h - rebase to v2.0.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - rebase to v2.0.7 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.4.128-1 - Added amdgpu-slice.patch and amdgpu-fallback.patch - Update to 2.4.127 amdgpu-apu.patch: Read model name from /proc/cpuinfo for APUs - Update to 2.4.123 Resolves: https://issues.redhat.com/browse/RHEL-53895 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 2.4.121 - Fix findings from static application security testing (SAST) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - enable c10s gating - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Link against libm - migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Version 2.7.0 - Bump release for SPDX rebuild - Related: RHEL-119484 - debugfs: byteswap dirsearch dirent buf on big endian systems Resolves: RHEL-74431 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Disable metadata_csum_seed and orphan_file features in mke2fs.conf - Rebase to new upstream - Remove stale patch from the package - Bump release for June 2024 mass rebuild - Recommends: /usr/sbin/sendmail rather than sendmail as many packages can provide a /usr/sbin/sendmail command - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for SPDX rebuild - Related: RHEL-119484 - debugfs: byteswap dirsearch dirent buf on big endian systems Resolves: RHEL-74431 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Disable metadata_csum_seed and orphan_file features in mke2fs.conf - Rebase to new upstream - Remove stale patch from the package - Bump release for June 2024 mass rebuild - Recommends: /usr/sbin/sendmail rather than sendmail as many packages can provide a /usr/sbin/sendmail command - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-add-DBXUpdate-20250610.aa64.bin.patch [RHEL-109548] - Resolves: RHEL-109548 ([aarch64][edk2] missing DBXUpdate-${date}.aa64.bin) - Rebase to edk2-stable202508 [RHEL-111718] - Resolves: RHEL-111718 ([edk2,rhel-10] rebase to edk2-stable202508) - edk2-add-qemu-vars-builds-to-build-config-and-file-lists.patch [RHEL-2908] - edk2-add-dbx-update-script.patch [RHEL-96866] - edk2-update-dbx-to-20250610.patch [RHEL-96866] - Resolves: RHEL-2908 ([aarch64][EDK2] UEFI writable variable service in QEMU) - Resolves: RHEL-96866 ([edk2,rhel-10] dbx update 20250610) - Pin the X64 firmware ISA baseline to x86-64-v2 - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z]) - Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2]) - edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573] - Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2]) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z]) - Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2]) - edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573] - Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2]) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-add-DBXUpdate-20250610.aa64.bin.patch [RHEL-109548] - Resolves: RHEL-109548 ([aarch64][edk2] missing DBXUpdate-${date}.aa64.bin) - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Convert license tags to SPDX - Fix build and reintroduce package - The build is fixed by importing patches from Ubuntu/SUSE - Patch to disable OpenSSL Engine support (deprecated in Fedora) is added - Drop %{_isa} from Requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 1.1.16 - Update to 1.1.15 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.1.13 - SPDX migration: license is already SPDX compatible - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add patch to fix rhbz#2223856 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 1.1.16 - Update to 1.1.15 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.1.13 - SPDX migration: license is already SPDX compatible - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add patch to fix rhbz#2223856 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: license is already SPDX compatible - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild with suitesparse 7.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop unused glew build dependency - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Avoid extra test dependencies in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - disable gpm integration for RHEL 10 (RHEL-23701) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rebase to latest upstream release (rhbz#2255830) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - new upstream release (rhbz#2192272) - migrate to SPDX license format - Port configure script to C99 - parallel builds cause FTBFS - Resolves: bz#2171476 - Initial elrepo-release package for rhel10 - Bump release for October 2024 mass rebuild: - RPMAUTOSPEC: unresolvable merge - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Version 13.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Version 13.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - tests: fix filter to include missing gating tests - tests: fix URL to internal tests repo - Unset custom linker flags - Improve the security of the generated code by hardening - Fix CVE-2024-53920 arbitrary code execution vulnerability - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - tests: fix filter to include missing gating tests - tests: fix URL to internal tests repo - Unset custom linker flags - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - tramp: restrict user name to prevent shell injection (CVE-2026-79992) - image: fix integer overflow in pbm_load (CVE-2026-77219) - Fix CVE-2024-53920 arbitrary code execution vulnerability - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - CI gating tests migration to tmt - Add explicit package version requirement for libtextstyle - Bump release for June 2024 mass rebuild - condition libtextstyle obsoletes - update to 0.22.5 release - https://savannah.gnu.org/news/?id=10597 - Add back libtextstyle library for rawhide (#2264128) - update to 0.22.4 release - https://savannah.gnu.org/news/?id=10544 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - tests: fix filter to include missing gating tests - tests: fix URL to internal tests repo - Unset custom linker flags - Improve the security of the generated code by hardening - Fix CVE-2024-53920 arbitrary code execution vulnerability - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - tests: fix filter to include missing gating tests - tests: fix URL to internal tests repo - Unset custom linker flags - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - tramp: restrict user name to prevent shell injection (CVE-2026-79992) - image: fix integer overflow in pbm_load (CVE-2026-77219) - Fix CVE-2024-53920 arbitrary code execution vulnerability - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - tests: fix filter to include missing gating tests - tests: fix URL to internal tests repo - Unset custom linker flags - Improve the security of the generated code by hardening - Fix CVE-2024-53920 arbitrary code execution vulnerability - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - tests: fix filter to include missing gating tests - tests: fix URL to internal tests repo - Unset custom linker flags - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - tramp: restrict user name to prevent shell injection (CVE-2026-79992) - image: fix integer overflow in pbm_load (CVE-2026-77219) - Fix CVE-2024-53920 arbitrary code execution vulnerability - Fix flymake tests with GCC 14 - Pong and Tetris are excluded - Fix man.el shell injection vulnerability - Add libtree-sitter as runtime dependency - Bump release - Bump release for October 2024 mass rebuild: - Bump release for October 2024 mass rebuild: - Resolves: RHEL-36638 Fix CI test - Resolves: RHEL-36633 Do not require gnome-session, gnome-shell, gnome- desktop-testing, ibus-desktop-testing, gnome-shell-extension-no-overview for the CI test - Resolves: RHEL-31506 Update to 2.25.11 - Yet another fix to make it possible again to use keys with Unicode keysyms in keybindings and make it work with all known versions of ibus (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/497) - Use NFC when doing the cursor correction after committing a preedit using space (Resolves: https://github.com/mike-fabian/ibus-typing- booster/issues/515) - Fix for ibus-1.5.30: Make it possible again to use keys with Unicode keysyms in keybindings (Resolves: https://github.com/mike-fabian/ibus- typing-booster/issues/497) - Bump release for June 2024 mass rebuild - Resolves: RHEL-36638 Update to 2.25.9 and Remove dependency on Xvfb from CI tests - Translation update from Weblate (cs 100%) - Update emoji annotations from CLDR - Drop Python < 3.6 support - Fix test_0_gtk.py: typing booster now avoids clearing the input in do_reset() when the preedit is empty - Remove dependency on Xvfb from ibus-typing-booster.spec - Support compose sequences containing ASCII keys written as <U00XX> code points (Resolves: https://github.com/mike-fabian/ibus-typing- booster/issues/510) - Translation update from Weblate (pt 91.3%) - adding gating.yaml - Resolves: RHEL-31506 Release 2.25.7 - Don’t use forward_key_event() on Gnome Wayland if the key might be a keyboard shortcut using a modifier (Resolves: https://github.com/mike- fabian/ibus-typing-booster/issues/507) - Resolves: RHEL-31506 Update to 2.25.6 - If Shift+something is pressed and then released, do not swallow the release of the Shift key (Resolves: https://github.com/mike-fabian/ibus- typing-booster/issues/504) - Decrease grid_row_spacing from 5 to 1 pixels to make the setup tool still fit on a 1024x768 pixel screen - Resolves: RHEL-31506 Update to 2.25.4 - Pass key which triggered cancel command to application if self._min_char_complete == 0 and there are no candidates (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/505) - Update emoji annotations from CLDR - Translation update from Weblate (ka 100%) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fixed buffer overflow in SetUpPhonemeTable function at synthdata.c Resolves: CVE-2023-49990 - Fixed buffer underflow in CountVowelPosition function at synthdata.c Resolves: CVE-2023-49991 - Fixed buffer overflow in RemoveEnding at dictionary.c Resolves: CVE-2023-49992 - Fixed buffer overflow in ReadClause function at readclause.c Resolves: CVE-2023-49993 - Fixed floating point exception in PeaksToHarmspect at wavegen.c Resolves: CVE-2023-49994 - Change license tag so it fully conforms to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fixed buffer overflow in SetUpPhonemeTable function at synthdata.c Resolves: CVE-2023-49990 - Fixed buffer underflow in CountVowelPosition function at synthdata.c Resolves: CVE-2023-49991 - Fixed buffer overflow in RemoveEnding at dictionary.c Resolves: CVE-2023-49992 - Fixed buffer overflow in ReadClause function at readclause.c Resolves: CVE-2023-49993 - Fixed floating point exception in PeaksToHarmspect at wavegen.c Resolves: CVE-2023-49994 - Change license tag so it fully conforms to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to 46.1 - Resolves: RHEL-35528 - Disable gspell - Resolves: RHEL-34802 - Migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0 - Update to 45.rc - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 45.alpha - Bump release for June 2024 mass rebuild - Update to 46.1 - Resolves: RHEL-35528 - Disable gspell - Resolves: RHEL-34802 - Migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0 - Update to 45.rc - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 45.alpha - Bump release for June 2024 mass rebuild - Update to 46.1 - Resolves: RHEL-35528 - Disable gspell - Resolves: RHEL-34802 - Migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0 - Update to 45.rc - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 45.alpha - Bump release for June 2024 mass rebuild - Update to 46.1 - Resolves: RHEL-35528 - Disable gspell - Resolves: RHEL-34802 - Migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0 - Update to 45.rc - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 45.alpha - Bump release for June 2024 mass rebuild - Update to 46.1 - Resolves: RHEL-35528 - Disable gspell - Resolves: RHEL-34802 - Migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0 - Update to 45.rc - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 45.alpha - Bump release for June 2024 mass rebuild - Update to 46.1 - Resolves: RHEL-35528 - Disable gspell - Resolves: RHEL-34802 - Migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0 - Update to 45.rc - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 45.alpha - Rebase to 2.7.3 and add VCS tag - https://issues.redhat.com/browse/RHELMISC-13073 - Fix behavior change caused by fix for CVE-2024-8176 - Fix CVE-2024-8176 - Rebase to 2.6.4 - Bump release for October 2024 mass rebuild: - Rebase to 2.6.2 - Bump release for June 2024 mass rebuild - Update of fmf plans and gating for c10s - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - expat: backport CVE-2026-45186 fix (attribute collision check DoS) - Rebase to 2.7.3 and add VCS tag - https://issues.redhat.com/browse/RHELMISC-13073 - Fix behavior change caused by fix for CVE-2024-8176 - Fix CVE-2024-8176 - Rebase to 2.6.4 - Bump release for October 2024 mass rebuild: - Rebase to 2.6.2 - Bump release for June 2024 mass rebuild - Update of fmf plans and gating for c10s - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219: forbid XML_ParserFree/Reset from handlers - expat: backport CVE-2026-45186 fix (attribute collision check DoS) - Rebase to 2.7.3 and add VCS tag - https://issues.redhat.com/browse/RHELMISC-13073 - Fix behavior change caused by fix for CVE-2024-8176 - Fix CVE-2024-8176 - Rebase to 2.6.4 - Bump release for October 2024 mass rebuild: - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219: forbid XML_ParserFree/Reset from handlers - expat: backport CVE-2026-45186 fix (attribute collision check DoS) - Rebase to 2.7.3 and add VCS tag - https://issues.redhat.com/browse/RHELMISC-13073 - Fix behavior change caused by fix for CVE-2024-8176 - Fix CVE-2024-8176 - Rebase to 2.6.4 - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over- read in XML_ParseBuffer - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219: forbid XML_ParserFree/Reset from handlers - expat: backport CVE-2026-45186 fix (attribute collision check DoS) - Rebase to 2.7.3 and add VCS tag - https://issues.redhat.com/browse/RHELMISC-13073 - Fix behavior change caused by fix for CVE-2024-8176 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use Tcl 8.4 channel type (GCC 14 compatibility) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update configure for building in strict C99 mode - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use Tcl 8.4 channel type (GCC 14 compatibility) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update configure for building in strict C99 mode - Bump release for June 2024 mass rebuild - [maven-release-plugin] prepare release oss-parent-57 (Tatu Saloranta) - Prepare for v57 release (Tatu Saloranta) - Update release notes (Tatu Saloranta) - Bump version.plugin.surefire from 3.2.3 to 3.2.5 (dependabot[bot]) - Bump org.apache.maven.plugins:maven-jxr-plugin from 3.3.1 to 3.3.2 (dependabot[bot]) - Update release notes wrt `version.plugin.compiler` bump (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-compiler-plugin (dependabot[bot]) - Update release notes (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-compiler-plugin (dependabot[bot]) - Update release notes wrt #115 (Tatu Saloranta) - Bump version.plugin.surefire from 3.2.2 to 3.2.3 (dependabot[bot]) - Update release notes (Tatu Saloranta) - Bump org.codehaus.mojo:build-helper-maven-plugin from 3.4.0 to 3.5.0 (dependabot[bot]) - Bump org.jacoco:jacoco-maven-plugin from 0.8.10 to 0.8.11 (dependabot[bot]) - Update release notes (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-project-info-reports-plugin (dependabot[bot]) - Update release notes (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.6.0 to 3.6.2 (dependabot[bot]) - Bump version.plugin.surefire from 3.2.1 to 3.2.2 (dependabot[bot]) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Resolves rhbz#2263613 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release oss-parent-56 (Tatu Saloranta) - Upgrade `version.plugin.moditect` to 1.1.0 (from 1.0.0-Final) (Tatu Saloranta) - Update release notes (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-pmd-plugin from 3.21.0 to 3.21.2 (dependabot[bot]) - Update release notes (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-clean-plugin from 3.3.1 to 3.3.2 (dependabot[bot]) - Update release notes wrt 3 plugin updates via dependabot PRs. (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-jxr-plugin from 3.3.0 to 3.3.1 (dependabot[bot]) - Bump version.plugin.surefire from 3.1.2 to 3.2.1 (dependabot[bot]) - Bump org.apache.maven.plugins:maven-dependency-plugin (dependabot[bot]) - update release notes (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-site-plugin (dependabot[bot]) - Update release notes x (Tatu Saloranta) - Bump org.ow2.asm:asm from 9.5 to 9.6 (dependabot[bot]) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Resolves rhbz#2248436 - [maven-release-plugin] prepare release oss-parent-55 (Tatu Saloranta) - Prepare for releasing v55 (Tatu Saloranta) - Bump org.apache.maven.plugins:maven-shade-plugin from 3.5.0 to 3.5.1 (dependabot[bot]) - Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.5.0 to 3.6.0 (dependabot[bot]) - Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.3.0 to 3.4.1 (dependabot[bot]) - Bump maven-site-plugin from 4.0.0-M8 to 4.0.0-M9 (dependabot[bot]) - Update Maven for wrapper (Tatu Saloranta) - Update release notes (Tatu Saloranta) - Bump maven-clean-plugin from 3.2.0 to 3.3.1 (dependabot[bot]) - Update release notes (Tatu Saloranta) - Bump maven-shade-plugin from 3.4.1 to 3.5.0 (dependabot[bot]) - update release notes (Tatu Saloranta) - Bump version.plugin.surefire from 3.1.0 to 3.1.2 (dependabot[bot]) - Bump maven-project-info-reports-plugin from 3.4.4 to 3.4.5 (dependabot[bot]) - Update release notes (Tatu Saloranta) - Bump maven-release-plugin from 3.0.0 to 3.0.1 (dependabot[bot]) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - [maven-release-plugin] prepare release oss-parent-54 (Tatu Saloranta) - Release 54 (Tatu Saloranta) - ... (Tatu Saloranta) - Update release notes (Tatu Saloranta) - Bump maven-project-info-reports-plugin from 3.4.3 to 3.4.4 (dependabot[bot]) - Bump maven-enforcer-plugin from 3.2.1 to 3.3.0 (dependabot[bot]) - Bump maven-install-plugin from 3.1.0 to 3.1.1 (dependabot[bot]) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Update to version 53 - Update to version 52 - new upstream release Resolves: RHEL-45835 - Bump release for June 2024 mass rebuild - lib/all agents: use r"" to avoid SyntaxWarnings Resolves: RHEL-35663 - fix pycurl bundled path Resolves: RHEL-35986 - Bundled missing libraries Resolves: RHEL-25954 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - new upstream release - new upstream release Resolves: RHEL-45835 - Bump release for June 2024 mass rebuild - lib/all agents: use r"" to avoid SyntaxWarnings Resolves: RHEL-35663 - fix pycurl bundled path Resolves: RHEL-35986 - Bundled missing libraries Resolves: RHEL-25954 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - new upstream release - bundled pyasn1: fix CVE-2026-23490 Resolves: RHEL-142445 - fence_ibm_vpc: fix missing statuses Resolves: RHEL-145086 - fence_virt: print error messages to sderr Resolves: RHEL-125959 - fence_gce: fix node list limit Resolves: RHEL-128925 - fence_ibm_powervs: update description of api-type parameter to show correct default value Resolves: RHEL-114752 - fence_aws: add "skip_os_shutdown" parameter to allow hard poweroff Resolves: RHEL-78241 - fence_ibm_vpc: add apikey file support Resolves: RHEL-107504 - fence_kubevirt: use hard poweroff Resolves: RHEL-95379 - fence_ibm_powervs: fix plaintext token file support Resolves: RHEL-88569 - fence_nutanix_ahv: new fence agent Resolves: RHEL-68322 - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157187, RHEL-155668 - bundled pyasn1: fix CVE-2026-23490 Resolves: RHEL-142445 - fence_ibm_vpc: fix missing statuses Resolves: RHEL-145086 - fence_virt: print error messages to sderr Resolves: RHEL-125959 - fence_gce: fix node list limit Resolves: RHEL-128925 - fence_ibm_powervs: update description of api-type parameter to show correct default value Resolves: RHEL-114752 - fence_aws: add "skip_os_shutdown" parameter to allow hard poweroff Resolves: RHEL-78241 - fence_ibm_vpc: add apikey file support Resolves: RHEL-107504 - fence_kubevirt: use hard poweroff Resolves: RHEL-95379 - bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939 Resolves: RHEL-193812 - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157187, RHEL-155668 - bundled pyasn1: fix CVE-2026-23490 Resolves: RHEL-142445 - fence_ibm_vpc: fix missing statuses Resolves: RHEL-145086 - fence_virt: print error messages to sderr Resolves: RHEL-125959 - fence_gce: fix node list limit Resolves: RHEL-128925 - fence_ibm_powervs: update description of api-type parameter to show correct default value Resolves: RHEL-114752 - fence_aws: add "skip_os_shutdown" parameter to allow hard poweroff Resolves: RHEL-78241 - fence_ibm_vpc: add apikey file support Resolves: RHEL-107504 - fence_openstack: fix list-action to avoid timeout when there are 100+ VMs on the hypervisor Resolves: RHEL-185610 - bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939 Resolves: RHEL-193812 - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157187, RHEL-155668 - bundled pyasn1: fix CVE-2026-23490 Resolves: RHEL-142445 - fence_ibm_vpc: fix missing statuses Resolves: RHEL-145086 - fence_virt: print error messages to sderr Resolves: RHEL-125959 - fence_gce: fix node list limit Resolves: RHEL-128925 - fence_ibm_powervs: update description of api-type parameter to show correct default value Resolves: RHEL-114752 - fence_aws: add "skip_os_shutdown" parameter to allow hard poweroff Resolves: RHEL-78241 - Fix TypeError: 'NoneType' object is not callable in magic.close() Resolves: RHEL-151423 - magic: Use the bcachefs-uuid for erofs Resolves: RHEL-76142 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add lp64d symlink to parent directory on riscv64 - Bump release for October 2024 mass rebuild: - Add ownership of /etc/default - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add /etc/keys for initrd/kernel related keys - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 140.10.1 ESR - Update to 140.10.0 ESR - Update to 140.9.1 ESR - Update to 140.9.0 ESR - Update to 140.8.0 ESR - Update to 140.7.0 ESR - Update to 140.6.0 ESR - Update to 140.5.0 ESR - Update to 140.4.0 ESR - Update to 140.3.0 - Update to 140.10.2 ESR - Update to 140.10.1 ESR - Update to 140.10.0 ESR - Update to 140.9.1 ESR - Update to 140.9.0 ESR - Update to 140.8.0 ESR - Update to 140.7.0 ESR - Update to 140.6.0 ESR - Update to 140.5.0 ESR - Update to 140.4.0 ESR - Update to 140.11.0 ESR - Update to 140.10.2 ESR - Update to 140.10.1 ESR - Update to 140.10.0 ESR - Update to 140.9.1 ESR - Update to 140.9.0 ESR - Update to 140.8.0 ESR - Update to 140.7.0 ESR - Update to 140.6.0 ESR - Update to 140.5.0 ESR - Update to 140.12.0 ESR - Update to 140.11.0 ESR - Update to 140.10.2 ESR - Update to 140.10.1 ESR - Update to 140.10.0 ESR - Update to 140.9.1 ESR - Update to 140.9.0 ESR - Update to 140.8.0 ESR - Update to 140.7.0 ESR - Update to 140.6.0 ESR - Update to 140.13.0 ESR - Update to 140.12.0 ESR - Update to 140.11.0 ESR - Update to 140.10.2 ESR - Update to 140.10.1 ESR - Update to 140.10.0 ESR - Update to 140.9.1 ESR - Update to 140.9.0 ESR - Update to 140.8.0 ESR - Update to 140.7.0 ESR - Update to 140.14.0 ESR - Update to 140.13.0 ESR - Update to 140.12.0 ESR - Update to 140.11.0 ESR - Update to 140.10.2 ESR - Update to 140.10.1 ESR - Update to 140.10.0 ESR - Update to 140.9.1 ESR - Update to 140.9.0 ESR - Update to 140.8.0 ESR - Update to 140.15.0 ESR - Update to 140.14.0 ESR - Update to 140.13.0 ESR - Update to 140.12.0 ESR - Update to 140.11.0 ESR - Update to 140.10.2 ESR - Update to 140.10.1 ESR - Update to 140.10.0 ESR - Update to 140.9.1 ESR - Update to 140.9.0 ESR - Update to 140.16.0 ESR - Update to 140.15.0 ESR - Update to 140.14.0 ESR - Update to 140.13.0 ESR - Update to 140.12.0 ESR - Update to 140.11.0 ESR - Update to 140.10.2 ESR - Update to 140.10.1 ESR - Update to 140.10.0 ESR - Update to 140.9.1 ESR - Update to 140.17.0 ESR - Update to 140.16.0 ESR - Update to 140.15.0 ESR - Update to 140.14.0 ESR - Update to 140.13.0 ESR - Update to 140.12.0 ESR - Update to 140.11.0 ESR - Update to 140.10.2 ESR - Update to 140.10.1 ESR - Update to 140.10.0 ESR - rebase package to v2.4.0 - rebase package to v2.3.1 - revert RHEL only patch to default StrictForwardPorts=yes - rebase package to v2.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebase package to v2.2.1 - fix firewalld.conf when upgrading from old versions that had a symlink - rebase package to v2.2.0 - Bump release for June 2024 mass rebuild - fix missing policykit symlink - rebase package to v2.4.2 - rebase package to v2.4.0 - rebase package to v2.3.1 - revert RHEL only patch to default StrictForwardPorts=yes - rebase package to v2.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebase package to v2.2.1 - fix firewalld.conf when upgrading from old versions that had a symlink - rebase package to v2.2.0 - Bump release for June 2024 mass rebuild - rebuild to bump NVR; no changes - rebase package to v2.4.3 - rebase package to v2.4.2 - rebase package to v2.4.0 - rebase package to v2.3.1 - revert RHEL only patch to default StrictForwardPorts=yes - rebase package to v2.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebase package to v2.2.1 - fix firewalld.conf when upgrading from old versions that had a symlink - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Check GPG signature - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Drop unused libusb-0.1 dependency - Update to latest upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.4.4 Resolves: RHEL-47749 - Remove dependency on Python2 Resolves: RHEL-68320 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 1.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.4.0 - Update to 1.3.5 - Update to 1.3.4 (#2212349) - Enable installed tests - Disable %check - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Disable git hooks when applying patches (CVE-2026-86320) Resolves: RHEL-262185 - Update to 1.4.4 Resolves: RHEL-47749 - Remove dependency on Python2 Resolves: RHEL-68320 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - kill: Do not kill pid 0 and embrace races Resolves: RHEL-140924 - Enable FIPS crypto policy if it is enabled on the host Resolves: RHEL-77484 - Get certificates from /etc/pki/entitlement for registry.redhat.io Resolves: RHEL-85004 - Fix wrongly marked failed installs as pre-installed Resolves: RHEL-89989 - Fix crash and installatcion of OCI images Resolves: RHEL-76958 - Rebuild with selinux-policy-40.13.23-1 Resolves: RHEL-36741 - Backport: Enable collection IDs for OCI remotes Resolves: RHEL-72779 - Rebase backported upstream patches to updated versions Resolves: RHEL-26066 - Update to 1.16.0 Resolves: RHEL-72779 - Add support for preinstalling Flatpaks Resolves: RHEL-26066 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157 - kill: Do not kill pid 0 and embrace races Resolves: RHEL-140924 - Enable FIPS crypto policy if it is enabled on the host Resolves: RHEL-77484 - Get certificates from /etc/pki/entitlement for registry.redhat.io Resolves: RHEL-85004 - Fix wrongly marked failed installs as pre-installed Resolves: RHEL-89989 - Fix crash and installatcion of OCI images Resolves: RHEL-76958 - Rebuild with selinux-policy-40.13.23-1 Resolves: RHEL-36741 - Backport: Enable collection IDs for OCI remotes Resolves: RHEL-72779 - Rebase backported upstream patches to updated versions Resolves: RHEL-26066 - Update to 1.16.0 Resolves: RHEL-72779 - Add support for preinstalling Flatpaks Resolves: RHEL-26066 - Avoid symlink path traversal in revokefs writer (CVE-2026-96808) Resolves: RHEL-267891 - Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275) Resolves: RHEL-267432 - Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280) Resolves: RHEL-271519 - Align backport with the other branches Resolves: RHEL-258970 - Harden data dir and var setup against symlink attacks Resolves: RHEL-258970 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157 - kill: Do not kill pid 0 and embrace races Resolves: RHEL-140924 - Enable FIPS crypto policy if it is enabled on the host Resolves: RHEL-77484 - Get certificates from /etc/pki/entitlement for registry.redhat.io Resolves: RHEL-85004 - Fix wrongly marked failed installs as pre-installed Resolves: RHEL-89989 - Fix crash and installatcion of OCI images Resolves: RHEL-76958 - Rebuild with selinux-policy-40.13.23-1 Resolves: RHEL-36741 - Update to 1.0.6 Resolves: RHEL-71540 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 3.4.2 (rhbz#2264712) - Disable ATLAS and BLIS in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.4.1 - Update to 3.4.0 - License changes to LGPL-3.0-or-later - Add Supplements to help pull wrappers if libraries are installed directly - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 3.4.2 (rhbz#2264712) - Disable ATLAS and BLIS in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.4.1 - Update to 3.4.0 - License changes to LGPL-3.0-or-later - Add Supplements to help pull wrappers if libraries are installed directly - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 3.4.2 (rhbz#2264712) - Disable ATLAS and BLIS in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.4.1 - Update to 3.4.0 - License changes to LGPL-3.0-or-later - Add Supplements to help pull wrappers if libraries are installed directly - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 3.4.2 (rhbz#2264712) - Disable ATLAS and BLIS in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.4.1 - Update to 3.4.0 - License changes to LGPL-3.0-or-later - Add Supplements to help pull wrappers if libraries are installed directly - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 3.4.2 (rhbz#2264712) - Disable ATLAS and BLIS in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.4.1 - Update to 3.4.0 - License changes to LGPL-3.0-or-later - Add Supplements to help pull wrappers if libraries are installed directly - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: RHEL-138134 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability - Resolves: RHEL-138159 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138144 CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138126 CVE-2025-15269 SFD File Parsing Use-After-Free - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-31498 various flaws CVE-2024-25081 and CVE-2024-25082 - Add gating.yaml file - Resolves: RHEL-138134 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability - Resolves: RHEL-138159 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138144 CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138126 CVE-2025-15269 SFD File Parsing Use-After-Free - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-31498 various flaws CVE-2024-25081 and CVE-2024-25082 - Add gating.yaml file - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add exact binary name in the file list. - Do not package backup files. Resolves: RHEL-54049 - Add %{epoch} in Requires line if needed - Support fontpkgheader macro for meta packages. - Drop YAML support in gen-fontconf for RHEL10 or later. - Bump release for June 2024 mass rebuild - Resolves: RHEL-38996 - Generate extra subpackages only for Fedora release - Update to 4.51.0 version (#2273774) - Resolves: RHEL-31499 - Update to 4.50.0 version - Update to 4.49.0 version (#2264616) - Update to 4.48.1 version (#2263197) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Remove version limit from lxml - Update to 4.47.2 version (#2257911) - Update to the upstream version 1.94.5 - Update to upstream version 1.94.4 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Expand licenses to SPDX identifiers - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release - Use the accidentally-dropped efi_os_dir - Ensure valgrind is disabled on arches without valgrind - Rebase to latest upstream version - Sync the content of main.fmf from rhel9 to rhel10 - Rebase to latest upstream version - Rebase to latest upstream version. - Set efi_os_dir to 'redhat', rather than using 'rhel' - Bump release for October 2024 mass rebuild: - Rebase to get hardware support for CERTPX-13842 - Bump release - Use the accidentally-dropped efi_os_dir - Ensure valgrind is disabled on arches without valgrind - Rebase to latest upstream version - Sync the content of main.fmf from rhel9 to rhel10 - Rebase to latest upstream version - Rebase to latest upstream version. - Set efi_os_dir to 'redhat', rather than using 'rhel' - Bump release for October 2024 mass rebuild: - Rebase to get hardware support for CERTPX-13842 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild with enabled gating Resolves RHEL-52115 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - 5.3.0 - libsigsegv should no longer be needed for the build Resolves rhbz#2247650 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - 5.2.2 - Disable the pma test for now (it breaks the build right now). Resolves rhbz#2124101 - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild with enabled gating Resolves RHEL-52115 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - 5.3.0 - libsigsegv should no longer be needed for the build Resolves rhbz#2247650 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - 5.2.2 - Disable the pma test for now (it breaks the build right now). Resolves rhbz#2124101 - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add MinGW packages. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - new version - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix compilation on RISC-V - update from releases/gcc-15 branch (RHEL-116507) - PRs ada/68179, ada/123060, ada/123088, ada/123096, ada/123138, ada/123185, ada/123289, ada/123302, ada/123306, ada/123371, ada/123589, analyzer/122975, analyzer/123085, c/123156, c++/91388, c++/114764, c++/116952, c++/120446, c++/121854, c++/121966, c++/122048, c++/122070, c++/122550, c++/122668, c++/122752, c++/122772, c++/122834, c++/122922, c++/123331, c++/123597, debug/121964, diagnostics/120063, fortran/107406, libfortran/122936, libstdc++/120446, libstdc++/122812, libstdc++/122907, libstdc++/123147, middle-end/111817, middle-end/123107, middle-end/123392, middle-end/123703, rtl-optimization/121773, rtl-optimization/122215, rtl-optimization/123121, rtl-optimization/123523, target/117575, target/119130, target/120250, target/121192, target/121485, target/123022, target/123092, target/123155, target/123217, target/123460, target/123484, target/123489, target/123521, target/123607, target/123742, testsuite/123353, tree-optimization/122793, tree-optimization/122868, tree-optimization/123040, tree-optimization/123300, tree-optimization/123351, tree-optimization/123372, tree-optimization/123431, tree-optimization/123513, tree-optimization/123602, tree-optimization/123736, tree-optimization/123741 - Fix glibc32 build dependency (RHEL-113183) - Drop the workaround for CVE-2025-5702 (RHEL-100161) - Require gcc-toolset-N-runtime (RHEL-94672) - ship libstdc++.modules.json (RHEL-97043) - configure with --with-long-double-format=ieee (RHEL-97055) - Tune for z16 on s390x by default on RHEL10 and later (RHEL-94282) - Add AS_NEEDED libstdc++.so.6 when only needed through libstdc++_nonshared (RHEL-84680) - configure with --enable-host-pie --enable-host-bind-now (RHEL-95595) - update from releases/gcc-15 branch - PRs ada/112958, ada/120104, c/120057, c++/119863, c++/119864, c++/119938, c++/119939, c++/119981, c++/119996, c++/120012, c++/120013, c++/120023, c++/120125, c++/120161, c++/120350, fortran/102891, fortran/102900, fortran/119928, fortran/119986, fortran/120049, fortran/120107, fortran/120139, fortran/120163, fortran/120179, fortran/120191, ipa/119852, ipa/119973, ipa/120006, ipa/120146, libfortran/120152, libfortran/120153, libfortran/120158, libfortran/120196, libstdc++/118260, libstdc++/119427, libstdc++/119714, libstdc++/120029, libstdc++/120114, libstdc++/120159, libstdc++/120187, libstdc++/120190, libstdc++/120198, libstdc++/120293, modula2/115276, modula2/119914, modula2/119915, modula2/120117, modula2/120188, preprocessor/116047, preprocessor/120061, target/119610, testsuite/119909, tree-optimization/111873, tree-optimization/119712, tree-optimization/120043, tree-optimization/120048, tree-optimization/120074, tree-optimization/120089, tree-optimization/120143, tree-optimization/120211 - update from releases/gcc-15 branch - GCC 15.1 release - PRs fortran/119836, target/119327, target/119873, tree-optimization/118407 - Rebuild for Konflux (Resolves: RHEL-84822) - Rebuild for Konflux - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump and rebuild package (for riscv64) - Rebuilt for libavif 1.0.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix LZW decompression in GIF handling (CVE-2026-9672) (Resolves: RHEL-259570) - Rebuild for Konflux (Resolves: RHEL-84822) - Rebuild for Konflux - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Use a SPDX license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix popt API misuse (#2100391) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - jpeg: Reject unsupported number of components - jpeg: Be more careful with chunked icc data - Bump release for October 2024 mass rebuild: - Recommend webp loader only on Fedora - Update to 2.42.12 and sync with Fedora - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX-format license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - New upstream release - Drop all patches - Exclude i686 for https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval - Migrate to SPDX license identifier - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - RHEL-46575 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction - RHEL-46149 CVE-2024-29509 ghostscript: heap buffer overflow via the PDFPassword parameter - RHEL-46131 CVE-2024-29508 ghostscript: heap pointer leak in pdf_base_font_alloc() - RHEL-46112 CVE-2024-29507 ghostscript: stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters - RHEL-46076 CVE-2024-29506 ghostscript: stack-based buffer overflow in the pdfi_apply_filter() - RHEL-44727 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass) - RHEL-44771 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths - Bump release for June 2024 mass rebuild - RHEL-38835 run the package with correct tests - RHEL-38835 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free bypass via Type 5 shading OOB write and procedure-stream use-after-free - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Revert the last change - Fix requirements after recent redhat-fonts change - Drop Source Code Pro depedency - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add patch to fix broken Since/Obsoletes - Update to 2023.3 (close RHBZ#2251397) - Package LICENSES/ as a directory - Bump release for June 2024 mass rebuild - Revert the last change - Fix requirements after recent redhat-fonts change - Drop Source Code Pro depedency - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add patch to fix broken Since/Obsoletes - Update to 2023.3 (close RHBZ#2251397) - Package LICENSES/ as a directory - Bump release for June 2024 mass rebuild - Revert the last change - Fix requirements after recent redhat-fonts change - Drop Source Code Pro depedency - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add patch to fix broken Since/Obsoletes - Update to 2023.3 (close RHBZ#2251397) - Package LICENSES/ as a directory - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Actually apply test patch Related: Resolves: RHEL-58016 - Update mozjs to 115.15.0 Resolves: RHEL-58016 - Replace xvfb dependency Resolves: RHEL-36637 - Bump bundled mozjs version Resolves: RHEL-45601 - Re-enable LTO for all archs Resolves: RHEL-40915 - Bump release for June 2024 mass rebuild - Adjust rpminspect configuration - Bundle mozjs on RHEL - Fix SPDX license information - Add rpminspect configuration - Update to 1.80.2 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Update to 2.80.0 - libproxy lives! Remove the !libproxy conditionals - Fix license tag so its validated by license-validate - Update file gating.yaml - Update to 2.80.alpha - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Run tests during check phase - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.66.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rename from glibmm24 to glibmm2.4 - Update to 2.66.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.66.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rename from glibmm24 to glibmm2.4 - Update to 2.66.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.66.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rename from glibmm24 to glibmm2.4 - Update to 2.66.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use SPDX license identifiers - 1.14.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - 1.12.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use SPDX license identifiers - 1.14.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - 1.12.1 - Release bump due to internal issue with the build system (missing debug symbols) Related: RHEL-24118 - Port the ibm z13 optimization patches Resolves: RHEL-24118 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - tests submodule needs explicit Requires - Add gnome-qr library used by passwordless GDM - Update to 44.1 - Drop live user mode patchset - Bump release for October 2024 mass rebuild: - Convert subpackages to SPDX license format - Fix license tag so its validated by license-validate - Add gating.yaml via API - Bump release for June 2024 mass rebuild - License migrated to SPDX format - Sync gnome-qr library patch series with upstream MR - Get qrcodegen tar file from lookaside cache - tests submodule needs explicit Requires - Add gnome-qr library used by passwordless GDM - Update to 44.1 - Drop live user mode patchset - Bump release for October 2024 mass rebuild: - Convert subpackages to SPDX license format - Fix license tag so its validated by license-validate - Add gating.yaml via API - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add a gating.yaml - Rebase to newer upstream version and remove a lot of downstream patches - Fix build with dnf5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Backport two patches from master to fix fwupd-efi - Richard's patch to drop -compat - Rebuild against updated golang - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - Rebuild go-fdo-server against updated golang - Rebuild against updated golang - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - Rebuild against updated golang - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - Rebuild go-fdo-server against updated golang - Rebuild against updated golang - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - Rebuild against updated golang - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - Rebuild go-fdo-server against updated golang - Rebuild against updated golang - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 - Rebuild to fix CVE-2026-32283 - Rebuild to fix CVE-2026-25679 and CVE-2026-27137 - Update to 1.0.0 upstream release - Add gating test for cs10 - Initial commit on c10s - add Provides: golang(github.com/russross/blackfriday/v2) - Resolves: RHEL-86199 - re-add -devel and compat - Resolves: RHEL-65351 - don't build devel and compat packages - Resolves: RHEL-65307 - RHEL-49443 Revert change in goipp regarding IPP standard breaking change - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2253306 - golang-github-openprinting-goipp-1.1.0 is available - Rebuild for any CVE fixes in golang - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuilt to fix CVE-2026-25679 - rebuilt to fix CVE-2025-68121, CVE-2025-61726 - rebuild to fix CVE-2025-61729 - rebuild to fix CVE-2025-22871 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - RHEL-49445 Rebase ipp-usb to 0.9.27 - RHEL-49445 Rebase ipp-usb to 0.9.26 - Bump release for June 2024 mass rebuild - rebuilt with golang-1.26.4-1.el10_2 to fix CVE-2026-33811, CVE-2026-27145 - rebuilt with golang-1.26.3-4.el10_2 to fix CVE-2026-32281 - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810 - rebuilt to fix CVE-2026-27137, CVE-2026-25679 - fixed rebuild problem with redundant condition check in quirks.empty() - rebuilt to fix CVE-2025-68121 and CVE-2025-61726 - rebuilt to fix CVE-2025-61729 - rebuild to fix CVE-2025-22871 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - RHEL-49445 Rebase ipp-usb to 0.9.27 - RHEL-49445 Rebase ipp-usb to 0.9.26 - Rebuilt with golang-1.26.7-1.el10_2 to fix CVE-2026-42504,CVE-2026-33818,CVE-2026-56853,CVE-2026-56859,CVE-2026-56860,CVE-2026-56862 - rebuilt with golang-1.26.4-1.el10_2 to fix CVE-2026-33811, CVE-2026-27145 - rebuilt with golang-1.26.3-4.el10_2 to fix CVE-2026-32281 - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810 - rebuilt to fix CVE-2026-27137, CVE-2026-25679 - fixed rebuild problem with redundant condition check in quirks.empty() - rebuilt to fix CVE-2025-68121 and CVE-2025-61726 - rebuilt to fix CVE-2025-61729 - rebuild to fix CVE-2025-22871 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix missing config files Resolves: RHEL-47276 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Convert License tag to SPDX. - Drop the font unification which causes a lot of problems. Resolves: rhbz#2186711, rhbz#2144373, rhbz#2096153, rhbz#517789 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix a typo in config. - Rename google-noto-sans-symbols2-fonts to google-noto-sans-symbols-2-fonts - Rename google-noto-sans-meeteimayek-vf-fonts to google-noto-sans-meetei-mayek-vf-fonts Resolves: RHEL-47289 - Bump release for June 2024 mass rebuild - Updates to monthly release of 24.4.1 - Add google-noto-fonts-all, google-noto-fonts-all-vf, and google-noto-fonts-all-static meta packages. - Add Obsoletes: google-noto-looped-thai-fonts in google-noto-sans-thai-looped-fonts. - Updates to monthly release of 24.3.1 - Add Obsolsetes: google-noto-sans-phags-pa-fonts in google-noto-sans-phagspa-fonts Resolves: rhbz#2265259 - Updates to monthly release of 24.2.1 - Updates to monthly release of 24.1.1 - Remove substitute config for Symbol. Resolves: rhbz#2259962 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix a typo in config. - Rename google-noto-sans-symbols2-fonts to google-noto-sans-symbols-2-fonts - Rename google-noto-sans-meeteimayek-vf-fonts to google-noto-sans-meetei-mayek-vf-fonts Resolves: RHEL-47289 - Bump release for June 2024 mass rebuild - Updates to monthly release of 24.4.1 - Add google-noto-fonts-all, google-noto-fonts-all-vf, and google-noto-fonts-all-static meta packages. - Add Obsoletes: google-noto-looped-thai-fonts in google-noto-sans-thai-looped-fonts. - Updates to monthly release of 24.3.1 - Add Obsolsetes: google-noto-sans-phags-pa-fonts in google-noto-sans-phagspa-fonts Resolves: rhbz#2265259 - Updates to monthly release of 24.2.1 - Updates to monthly release of 24.1.1 - Remove substitute config for Symbol. Resolves: rhbz#2259962 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix a typo in config. - Rename google-noto-sans-symbols2-fonts to google-noto-sans-symbols-2-fonts - Rename google-noto-sans-meeteimayek-vf-fonts to google-noto-sans-meetei-mayek-vf-fonts Resolves: RHEL-47289 - Bump release for June 2024 mass rebuild - Updates to monthly release of 24.4.1 - Add google-noto-fonts-all, google-noto-fonts-all-vf, and google-noto-fonts-all-static meta packages. - Add Obsoletes: google-noto-looped-thai-fonts in google-noto-sans-thai-looped-fonts. - Updates to monthly release of 24.3.1 - Add Obsolsetes: google-noto-sans-phags-pa-fonts in google-noto-sans-phagspa-fonts Resolves: rhbz#2265259 - Updates to monthly release of 24.2.1 - Updates to monthly release of 24.1.1 - Remove substitute config for Symbol. Resolves: rhbz#2259962 - fix buffer overflow in NMEA2000 driver (CVE-2025-67268) - fix integer underflow in handling of Navcom packets (CVE-2025-67269) - add support note to package descriptions (RHEL-113507) - update to 3.26.1 (RHEL-94234) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix icon path in desktop files (RHEL-34158) - replace gpsd-minimal conflicts with obsoletes (RHEL-33651) - fix annobin coverage (RHEL-33496) - add conflicts for gpsd-minimal (RHEL-33651) - drop compat subpackage (RHEL-33651) - fix dependencies for build without libs - rebuild - internalize scons (RHEL-14750) - add missing IPv6 support - add note about limited Red Hat support - drop unneeded API-compatibility patch - fix busy wait when reading from gpsd socket - fix some issues reported by coverity and shellcheck - fix command injection in gpsprof (CVE-2026-58459) - fix buffer overflow in NMEA2000 driver (CVE-2025-67268) - fix integer underflow in handling of Navcom packets (CVE-2025-67269) - add support note to package descriptions (RHEL-113507) - update to 3.26.1 (RHEL-94234) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix another command injection in gpsprof (CVE-2026-60122) - fix command injection in gpsprof (CVE-2026-58459) - fix buffer overflow in NMEA2000 driver (CVE-2025-67268) - fix integer underflow in handling of Navcom packets (CVE-2025-67269) - add support note to package descriptions (RHEL-113507) - update to 3.26.1 (RHEL-94234) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Dropped ocaml in RHEL>9 Resolves: RHEL-16474 - Rebuild for golang 1.22.0 - Added hpnd-uc license - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Use transaction file triggers to configure plugins - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Dropped ocaml in RHEL>9 Resolves: RHEL-16474 - Rebuild for golang 1.22.0 - Added hpnd-uc license - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Use transaction file triggers to configure plugins - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Dropped ocaml in RHEL>9 Resolves: RHEL-16474 - Rebuild for golang 1.22.0 - Added hpnd-uc license - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Use transaction file triggers to configure plugins - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Dropped ocaml in RHEL>9 Resolves: RHEL-16474 - Rebuild for golang 1.22.0 - Added hpnd-uc license - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Use transaction file triggers to configure plugins - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Dropped ocaml in RHEL>9 Resolves: RHEL-16474 - Rebuild for golang 1.22.0 - Added hpnd-uc license - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Use transaction file triggers to configure plugins - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Dropped ocaml in RHEL>9 Resolves: RHEL-16474 - Rebuild for golang 1.22.0 - Added hpnd-uc license - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Use transaction file triggers to configure plugins - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase for added gating - Fix SAST identified true positives - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix alternatives usage - Revert upstream change of mapping special characters for UTF-8 devices - Resolves: BZ#2224123 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to version 1.23.0 - Several files were removed from groff package - Several files were added to groff package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase for added gating - Fix SAST identified true positives - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix alternatives usage - Revert upstream change of mapping special characters for UTF-8 devices - Resolves: BZ#2224123 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to version 1.23.0 - Several files were removed from groff package - Several files were added to groff package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase for added gating - Fix SAST identified true positives - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix alternatives usage - Revert upstream change of mapping special characters for UTF-8 devices - Resolves: BZ#2224123 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to version 1.23.0 - Several files were removed from groff package - Several files were added to groff package - Debrand for AlmaLinux - Build btrfs module - New package grub2-efi-x64-cc for confidential computing workloads - Resolves: #RHEL-127909 - Try to get gating tests running via fmf/tmt - Resolves: #RHEL-147757 - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148309 - Bump release - Related: #RHEL-146590 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146590 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24510 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24510 - commands/search.c: check possible NULL pointer before dereference - Resolves: #RHEL-146317 - Fix several security issues about module unloading and file handling - Resolves: #RHEL-141581 - Resolves: #CVE-2025-54770 #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - Debrand for AlmaLinux - Build btrfs module - New package grub2-efi-x64-cc for confidential computing workloads - Resolves: #RHEL-127909 - Try to get gating tests running via fmf/tmt - Resolves: #RHEL-147757 - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148309 - Bump release - Related: #RHEL-146590 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146590 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24510 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24510 - commands/search.c: check possible NULL pointer before dereference - Resolves: #RHEL-146317 - Fix several security issues about module unloading and file handling - Resolves: #RHEL-141581 - Resolves: #CVE-2025-54770 #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - Debrand for AlmaLinux - Build btrfs module - New package grub2-efi-x64-cc for confidential computing workloads - Resolves: #RHEL-127909 - Try to get gating tests running via fmf/tmt - Resolves: #RHEL-147757 - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148309 - Bump release - Related: #RHEL-146590 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146590 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24510 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24510 - commands/search.c: check possible NULL pointer before dereference - Resolves: #RHEL-146317 - Fix several security issues about module unloading and file handling - Resolves: #RHEL-141581 - Resolves: #CVE-2025-54770 #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - Debrand for AlmaLinux - Build btrfs module - New package grub2-efi-x64-cc for confidential computing workloads - Resolves: #RHEL-127909 - Try to get gating tests running via fmf/tmt - Resolves: #RHEL-147757 - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148309 - Bump release - Related: #RHEL-146590 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146590 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24510 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24510 - commands/search.c: check possible NULL pointer before dereference - Resolves: #RHEL-146317 - Fix several security issues about module unloading and file handling - Resolves: #RHEL-141581 - Resolves: #CVE-2025-54770 #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - Debrand for AlmaLinux - Build btrfs module - New package grub2-efi-x64-cc for confidential computing workloads - Resolves: #RHEL-127909 - Try to get gating tests running via fmf/tmt - Resolves: #RHEL-147757 - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148309 - Bump release - Related: #RHEL-146590 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146590 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24510 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24510 - commands/search.c: check possible NULL pointer before dereference - Resolves: #RHEL-146317 - Fix several security issues about module unloading and file handling - Resolves: #RHEL-141581 - Resolves: #CVE-2025-54770 #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - Debrand for AlmaLinux - Build btrfs module - New package grub2-efi-x64-cc for confidential computing workloads - Resolves: #RHEL-127909 - Try to get gating tests running via fmf/tmt - Resolves: #RHEL-147757 - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148309 - Bump release - Related: #RHEL-146590 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146590 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24510 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24510 - commands/search.c: check possible NULL pointer before dereference - Resolves: #RHEL-146317 - Fix several security issues about module unloading and file handling - Resolves: #RHEL-141581 - Resolves: #CVE-2025-54770 #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - Debrand for AlmaLinux - Build btrfs module - New package grub2-efi-x64-cc for confidential computing workloads - Resolves: #RHEL-127909 - Try to get gating tests running via fmf/tmt - Resolves: #RHEL-147757 - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148309 - Bump release - Related: #RHEL-146590 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146590 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24510 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24510 - commands/search.c: check possible NULL pointer before dereference - Resolves: #RHEL-146317 - Fix several security issues about module unloading and file handling - Resolves: #RHEL-141581 - Resolves: #CVE-2025-54770 #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - License converted to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705) Resolves: RHEL-184480 - Add patch for CVE-2026-3083 and CVE-2026-3085 Resolves: RHEL-156133, RHEL-156112 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - Update to 1.24.11 Resolves: RHEL-73676 - Update to 1.24.10 Resolves: RHEL-70408, RHEL-71032, RHEL-71020, RHEL-70996 Resolves: RHEL-70960, RHEL-70947, RHEL-70934 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - 1.24.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - 1.24.5 - Fix integer overflow and bounds check vulnerabilities in uncompressed video handling (CVE-2026-5056) Resolves: RHEL-222333 - Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705) Resolves: RHEL-184480 - Add patch for CVE-2026-3083 and CVE-2026-3085 Resolves: RHEL-156133, RHEL-156112 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - Update to 1.24.11 Resolves: RHEL-73676 - Update to 1.24.10 Resolves: RHEL-70408, RHEL-71032, RHEL-71020, RHEL-70996 Resolves: RHEL-70960, RHEL-70947, RHEL-70934 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix excessive memory allocation from malicious RTP fragmentation unit packets in rtph264depay/rtph265depay (CVE-2026-18649) Resolves: RHEL-224158 - Fix integer overflow and bounds check vulnerabilities in uncompressed video handling (CVE-2026-5056) Resolves: RHEL-222333 - Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705) Resolves: RHEL-184480 - Add patch for CVE-2026-3083 and CVE-2026-3085 Resolves: RHEL-156133, RHEL-156112 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - Update to 1.24.11 Resolves: RHEL-73676 - Update to 1.24.10 Resolves: RHEL-70408, RHEL-71032, RHEL-71020, RHEL-70996 Resolves: RHEL-70960, RHEL-70947, RHEL-70934 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239045 - Fix out-of-bounds reads when parsing FUJIFILM strd metadata in AVI files (CVE-2026-73433) Resolves: RHEL-239062 - Fix excessive memory allocation from malicious RTP fragmentation unit packets in rtph264depay/rtph265depay (CVE-2026-18649) Resolves: RHEL-224158 - Fix integer overflow and bounds check vulnerabilities in uncompressed video handling (CVE-2026-5056) Resolves: RHEL-222333 - Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705) Resolves: RHEL-184480 - Add patch for CVE-2026-3083 and CVE-2026-3085 Resolves: RHEL-156133, RHEL-156112 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - Update to 1.24.11 Resolves: RHEL-73676 - Update to 1.24.10 Resolves: RHEL-70408, RHEL-71032, RHEL-71020, RHEL-70996 Resolves: RHEL-70960, RHEL-70947, RHEL-70934 - Fix CVE-2026-18298 in gdkpixbufdec element Resolves: RHEL-246557 - Fix insufficient size validation in MRF file parsing in qtmoovrecover (CVE-2026-18296) Resolves: RHEL-246546 - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239045 - Fix out-of-bounds reads when parsing FUJIFILM strd metadata in AVI files (CVE-2026-73433) Resolves: RHEL-239062 - Fix excessive memory allocation from malicious RTP fragmentation unit packets in rtph264depay/rtph265depay (CVE-2026-18649) Resolves: RHEL-224158 - Fix integer overflow and bounds check vulnerabilities in uncompressed video handling (CVE-2026-5056) Resolves: RHEL-222333 - Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705) Resolves: RHEL-184480 - Add patch for CVE-2026-3083 and CVE-2026-3085 Resolves: RHEL-156133, RHEL-156112 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - Fix use-after-free vulnerability in RTP SBC depayloader (CVE-2026-18299) Resolves: RHEL-246613 - Fix CVE-2026-18298 in gdkpixbufdec element Resolves: RHEL-246557 - Fix insufficient size validation in MRF file parsing in qtmoovrecover (CVE-2026-18296) Resolves: RHEL-246546 - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239045 - Fix out-of-bounds reads when parsing FUJIFILM strd metadata in AVI files (CVE-2026-73433) Resolves: RHEL-239062 - Fix excessive memory allocation from malicious RTP fragmentation unit packets in rtph264depay/rtph265depay (CVE-2026-18649) Resolves: RHEL-224158 - Fix integer overflow and bounds check vulnerabilities in uncompressed video handling (CVE-2026-5056) Resolves: RHEL-222333 - Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705) Resolves: RHEL-184480 - Add patch for CVE-2026-3083 and CVE-2026-3085 Resolves: RHEL-156133, RHEL-156112 - Update to 1.26.7 Resolves: RHEL-126057 - Add patch for CVE-2026-3083 and CVE-2026-3085 Resolves: RHEL-156142, RHEL-156119 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - Update to 1.24.11 Resolves: RHEL-73676 - Update to 1.24.10 Resolves: RHEL-70408, RHEL-71032, RHEL-71020, RHEL-70996 Resolves: RHEL-70960, RHEL-70947, RHEL-70934 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - 1.24.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - 1.24.5 - 1.24.4 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - Update to 1.24.11 Resolves: RHEL-73678 - Update to 1.24.10 Resolves: RHEL-71154 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - 1.24.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - 1.24.5 - 1.24.4 - 1.24.3 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use SPDX license identifiers - 1.14.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - 1.12.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use SPDX license identifiers - 1.14.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - 1.12.1 - Await more motion events before deactivating menus Resolves: RHEL-47037 - Stop relying on xpms in the testsuite Resolves: RHEL-69453 - Avoid criticals on headless systems Resolves: RHEL-40884 - Hide emoji chooser unless explicitly requested Resolves: RHEL-65214 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Don't require package gtk-immodules-imsettings as it isn't part of RHEL 10 (it's built from GTK 2 SRPM which isn't presented) - Resolves: RHEL-38223 - Update to 3.24.43 - Resolves: RHEL-46990 - Bump release for June 2024 mass rebuild - Update to 3.24.42 - Enable profiler support - Update to 3.24.41 - Update to 3.24.40 - Update to 3.24.39 - Bump release for June 2024 mass rebuild - gating.yaml - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license - Update to 3.24.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rename from gtkmm30 to gtkmm3.0 - Update to 3.24.7 - Bump release for June 2024 mass rebuild - gating.yaml - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license - Update to 3.24.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rename from gtkmm30 to gtkmm3.0 - Update to 3.24.7 - Bump release for June 2024 mass rebuild - gating.yaml - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license - Update to 3.24.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rename from gtkmm30 to gtkmm3.0 - Update to 3.24.7 - Update to 5.14.2 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.10.0 - Update to 5.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Enable building for ppc64le - Fix binary LUKS keys resolves: RHEL-174518 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174517 - Write sentinel file after firstboot scripts finish related: RHEL-161192 - Fix location of Windows Vista and Windows 2008 Server R1 drivers related: RHEL-174513 - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - New stable version 1.52.1 - Rebase on top of patches from RHEL 9.5 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-56319 - customize: Implement --inject-blnsvr operation resolves: RHEL-56330 - Add support for nbd+unix:// URIs resolves: RHEL-56332 - Enable building for ppc64le - Drop setfiles -F flag resolves: RHEL-260203 - Fix binary LUKS keys resolves: RHEL-174518 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174517 - Write sentinel file after firstboot scripts finish related: RHEL-161192 - Fix location of Windows Vista and Windows 2008 Server R1 drivers related: RHEL-174513 - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - Enable building for ppc64le - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - New stable version 1.52.1 - Rebase on top of patches from RHEL 9.5 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-56319 - customize: Implement --inject-blnsvr operation resolves: RHEL-56330 - Add support for nbd+unix:// URIs resolves: RHEL-56332 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - Enable building for ppc64le - Fix binary LUKS keys resolves: RHEL-174518 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174517 - Write sentinel file after firstboot scripts finish related: RHEL-161192 - Fix location of Windows Vista and Windows 2008 Server R1 drivers related: RHEL-174513 - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - New stable version 1.52.1 - Rebase on top of patches from RHEL 9.5 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-56319 - customize: Implement --inject-blnsvr operation resolves: RHEL-56330 - Add support for nbd+unix:// URIs resolves: RHEL-56332 - Enable building for ppc64le - Drop setfiles -F flag resolves: RHEL-260203 - Fix binary LUKS keys resolves: RHEL-174518 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174517 - Write sentinel file after firstboot scripts finish related: RHEL-161192 - Fix location of Windows Vista and Windows 2008 Server R1 drivers related: RHEL-174513 - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - Enable building for ppc64le - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - New stable version 1.52.1 - Rebase on top of patches from RHEL 9.5 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-56319 - customize: Implement --inject-blnsvr operation resolves: RHEL-56330 - Add support for nbd+unix:// URIs resolves: RHEL-56332 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - Enable building for ppc64le - Fix binary LUKS keys resolves: RHEL-174518 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174517 - Write sentinel file after firstboot scripts finish related: RHEL-161192 - Fix location of Windows Vista and Windows 2008 Server R1 drivers related: RHEL-174513 - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - New stable version 1.52.1 - Rebase on top of patches from RHEL 9.5 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-56319 - customize: Implement --inject-blnsvr operation resolves: RHEL-56330 - Add support for nbd+unix:// URIs resolves: RHEL-56332 - Enable building for ppc64le - Drop setfiles -F flag resolves: RHEL-260203 - Fix binary LUKS keys resolves: RHEL-174518 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174517 - Write sentinel file after firstboot scripts finish related: RHEL-161192 - Fix location of Windows Vista and Windows 2008 Server R1 drivers related: RHEL-174513 - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - Enable building for ppc64le - Synchronize spec file with Fedora - Fix pnputils after virt-customize --inject-virtio-win resolves: RHEL-116537 - Unify spec files between Fedora and RHEL. - Ensure a minimum version of libguestfs is installed at build and run time. resolves: RHEL-116716 - Remove virt-customize subscription-manager options resolves: RHEL-122307 - Add AV and GPOs to virt-inspector output resolves: RHEL-125955 - Expose XFS version in virt-filesystems resolves: RHEL-144074 - Rebase to guestfs-tools 1.54.0 resolves: RHEL-81734 - virt-builder, virt-v2v & other tools with -v and --install causes dnf5 error resolves: RHEL-83201 - virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-92604 - builder: Update link to templates to use https resolves: RHEL-94873 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109129 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56812 - Replace Jansson with json-c resolves: RHEL-65295 - New stable version 1.52.1 - Rebase on top of patches from RHEL 9.5 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-56319 - customize: Implement --inject-blnsvr operation resolves: RHEL-56330 - Add support for nbd+unix:// URIs resolves: RHEL-56332 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport upstream patch to fix C compatibility issue - make gutenprint and gutenprint-libs-ui dependant on cups-client - both checks for existence of lp - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Replace python3-chardet with python3-charset-normalizer - GTK2 is not in CentOS Stream 10, dont ship libs-ui subpackage there - Add other licenses to License tag and use SPDX identifiers to comply with FPG - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.3.1 release - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.3.1 release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 4.8 - opt-in to autochangelog - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Disable Qt5 GUI in RHEL 10 builds - update to 4.6 - Update to 4.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Enable CONFIG_IEEE80211BE Resolves: RHEL-58728 - Update to upstream version 2.11 Resolves: RHEL-58728, RHEL-43497 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix potential regressions after rebase from f40 - Disable ENGINE API and enable SUITE B-192 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Correct path for example hostapd.conf cited in hostapd.conf.5 - Fix OOB memory access in Multi-Link Operation element parsing Resolves: RHEL-194049 - Enable CONFIG_IEEE80211BE Resolves: RHEL-58728 - Update to upstream version 2.11 Resolves: RHEL-58728, RHEL-43497 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream version Resolves: RHEL-39142 and RHEL-49501 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Updated to version 2.10.0 - Updated to version 2.9.3 - hwloc.spec: migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - oneapi-level-zero-devel is ExclusiveArch x86_64 - add BRs for optional hwloc functionality - Bump to 1.5.17 - Bump release for October 2024 mass rebuild: - tests: Move gnome-calendar and gnome-epub-thumbnailer to Fedora only - tests: Add gnome-shell-47 to no-overview extension - tests: gdm-47~alpha-4 provides headless files - Update CI for RHEL10 - Add no-overview@fthx until gnome-shell-extension-no-overview is available - Add gnome-headless-session@.service until GDM will provide it - tests: Delete RHEL specific packages - tests: Update packages with comps-f41 - Add base-graphical - Add fonts default - Delete libcanberra-gtk3, libproxy-duktape - Delete tmt for RHEL CI - Replace STI with TMT in CI - Support GNOME Wayland and GTK4 in CI - Bump to 1.5.17 - Bump release for October 2024 mass rebuild: - tests: Move gnome-calendar and gnome-epub-thumbnailer to Fedora only - tests: Add gnome-shell-47 to no-overview extension - tests: gdm-47~alpha-4 provides headless files - Update CI for RHEL10 - Add no-overview@fthx until gnome-shell-extension-no-overview is available - Add gnome-headless-session@.service until GDM will provide it - tests: Delete RHEL specific packages - tests: Update packages with comps-f41 - Add base-graphical - Add fonts default - Delete libcanberra-gtk3, libproxy-duktape - Delete tmt for RHEL CI - Replace STI with TMT in CI - Support GNOME Wayland and GTK4 in CI - Resolves: RHEL-83888 Bump to 1.5.32 - Rebuild to export GSK_RENDERER=cairo in CentOS but not RHEL for Vulkan - Move gnome-calendar & gnome-epub-thumbnailer to Fedora specific in CI - Bump to 1.5.31 - Delete RHEL specific packages - Update installed packages in CI - configure option for Flatpak build - Move xinit post scripts - Require gnome-shell-extension-no-overview in RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Delete tmt installation for RHEL10 CI - Disable ibus-panel rich condition in RHEL - Delete ibus-xx-desktop-testing-mutter.patch - Delete libXtst-devel dependency - Replace gnome-terminal with ptyxis - Install gnome-desktop-testing for RHEL - Delete xorg-x11-server-Xvfb gnome-session-xsession - Delete build packages for gnome-desktop-testing for RHEL - Move evince gnome-logs gvfs-fuse gvfs-gphoto2 gvfs-smb to Fedora specific - Fix CI test case conditions - Add no-overview@fthx until gnome-shell-extension-no-overview is available - Add gnome-headless-session@.service until GDM will provide it - Replace GNOME Xorg with GNOME Wayland in CI - Replace STI with TMT in CI - Update CI for RHEL packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Fix some issue with On Screen Keyboard - Add ibus-hangul-fixes-osk.patch - Resolves: RHEL-69510 - Update CI tests - Resolves: RHEL-70370 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license - Update to 1.5.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.8.12 - appdata.xml files are now included upstream, remove from the .spec file - Migrate license tags to SPDX format - Update to 1.8.11 - Improve punctuation support in jyutping.txt, cantonese.txt, cantonhk.txt, cantonyale.txt (Resolves: https://github.com/mike-fabian/ibus-table-chinese/issues/7) - Improve “improve_jyutping.py” to allow comments in the table - Update of jyutping.txt for Unicode 15.0.0 final release - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream 1.3.17 - Rename emoji-table to emoticon-table Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/15 - Remove useless m4/as-version.m4 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/36 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream 1.3.16 - hu-old-hungarian-rovas: several improvements, most of them suggested by Viktor Kovács <kov.h.vik@gmail.com> Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/33 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/34 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/30 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/31 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/35 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/32 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/29 - Update to latest upstream 1.3.15 - Remove { and } from VALID_INPUT_CHARS in latex.txt - Add “Mongol bichig” to README - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.3.14 - Migrate license tags to SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream 1.3.17 - Rename emoji-table to emoticon-table Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/15 - Remove useless m4/as-version.m4 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/36 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream 1.3.16 - hu-old-hungarian-rovas: several improvements, most of them suggested by Viktor Kovács <kov.h.vik@gmail.com> Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/33 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/34 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/30 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/31 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/35 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/32 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/29 - Update to latest upstream 1.3.15 - Remove { and } from VALID_INPUT_CHARS in latex.txt - Add “Mongol bichig” to README - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.3.14 - Migrate license tags to SPDX - Bump release for October 2024 mass rebuild: - Resolves: RHEL-36633 Do not require gnome-session, gnome-shell, gnome- shell-extension-no-overview for the CI test - Update to 1.17.6 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.17.4 - Fix compose support for ibus >= 1.5.28 (Resolves: https://github.com/mike-fabian/ibus-table/issues/145) - Translation update from Weblate (New language, Russian, (ru) 80%) - Use “<developer><name>…</name></developer>” in ibus-table.appdata.xml instead of “<developer_name>…</developer_name>” Because </developer_name> is deprecated and it makes the build fail on Fedora rawhide. - Update to 1.17.3 - Support several backends for playing sounds Resolves: rhbz#2237674 https://bugzilla.redhat.com/show_bug.cgi?id=2237674 - Update Unihan_Variants.txt and regenerate engine/chinese_variants.py to Unicode Version 15.1.0 - Update to 1.17.2 - Translation update from Weblate (de 100%, tr 100%) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream 1.3.17 - Rename emoji-table to emoticon-table Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/15 - Remove useless m4/as-version.m4 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/36 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream 1.3.16 - hu-old-hungarian-rovas: several improvements, most of them suggested by Viktor Kovács <kov.h.vik@gmail.com> Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/33 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/34 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/30 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/31 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/35 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/32 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/29 - Update to latest upstream 1.3.15 - Remove { and } from VALID_INPUT_CHARS in latex.txt - Add “Mongol bichig” to README - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.3.14 - Migrate license tags to SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream 1.3.17 - Rename emoji-table to emoticon-table Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/15 - Remove useless m4/as-version.m4 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/36 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream 1.3.16 - hu-old-hungarian-rovas: several improvements, most of them suggested by Viktor Kovács <kov.h.vik@gmail.com> Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/33 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/34 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/30 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/31 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/35 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/32 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/29 - Update to latest upstream 1.3.15 - Remove { and } from VALID_INPUT_CHARS in latex.txt - Add “Mongol bichig” to README - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.3.14 - Migrate license tags to SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream 1.3.17 - Rename emoji-table to emoticon-table Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/15 - Remove useless m4/as-version.m4 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/36 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream 1.3.16 - hu-old-hungarian-rovas: several improvements, most of them suggested by Viktor Kovács <kov.h.vik@gmail.com> Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/33 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/34 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/30 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/31 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/35 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/32 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/29 - Update to latest upstream 1.3.15 - Remove { and } from VALID_INPUT_CHARS in latex.txt - Add “Mongol bichig” to README - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.3.14 - Migrate license tags to SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream 1.3.17 - Rename emoji-table to emoticon-table Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/15 - Remove useless m4/as-version.m4 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/36 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream 1.3.16 - hu-old-hungarian-rovas: several improvements, most of them suggested by Viktor Kovács <kov.h.vik@gmail.com> Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/33 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/34 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/30 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/31 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/35 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/32 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/29 - Update to latest upstream 1.3.15 - Remove { and } from VALID_INPUT_CHARS in latex.txt - Add “Mongol bichig” to README - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.3.14 - Migrate license tags to SPDX - Bump release for October 2024 mass rebuild: - Resolves: RHEL-36633 Do not require gnome-session, gnome-shell, gnome- shell-extension-no-overview for the CI test - Update to 1.17.6 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.17.4 - Fix compose support for ibus >= 1.5.28 (Resolves: https://github.com/mike-fabian/ibus-table/issues/145) - Translation update from Weblate (New language, Russian, (ru) 80%) - Use “<developer><name>…</name></developer>” in ibus-table.appdata.xml instead of “<developer_name>…</developer_name>” Because </developer_name> is deprecated and it makes the build fail on Fedora rawhide. - Update to 1.17.3 - Support several backends for playing sounds Resolves: rhbz#2237674 https://bugzilla.redhat.com/show_bug.cgi?id=2237674 - Update Unihan_Variants.txt and regenerate engine/chinese_variants.py to Unicode Version 15.1.0 - Update to 1.17.2 - Translation update from Weblate (de 100%, tr 100%) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream 1.3.17 - Rename emoji-table to emoticon-table Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/15 - Remove useless m4/as-version.m4 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/36 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream 1.3.16 - hu-old-hungarian-rovas: several improvements, most of them suggested by Viktor Kovács <kov.h.vik@gmail.com> Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/33 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/34 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/30 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/31 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/35 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/32 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/29 - Update to latest upstream 1.3.15 - Remove { and } from VALID_INPUT_CHARS in latex.txt - Add “Mongol bichig” to README - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.3.14 - Migrate license tags to SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream 1.3.17 - Rename emoji-table to emoticon-table Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/15 - Remove useless m4/as-version.m4 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/36 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to latest upstream 1.3.16 - hu-old-hungarian-rovas: several improvements, most of them suggested by Viktor Kovács <kov.h.vik@gmail.com> Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/33 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/34 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/30 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/31 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/35 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/32 Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/29 - Update to latest upstream 1.3.15 - Remove { and } from VALID_INPUT_CHARS in latex.txt - Add “Mongol bichig” to README - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.3.14 - Migrate license tags to SPDX - Resolves: RHEL-83888 Bump to 1.5.32 - Rebuild to export GSK_RENDERER=cairo in CentOS but not RHEL for Vulkan - Move gnome-calendar & gnome-epub-thumbnailer to Fedora specific in CI - Bump to 1.5.31 - Delete RHEL specific packages - Update installed packages in CI - configure option for Flatpak build - Move xinit post scripts - Require gnome-shell-extension-no-overview in RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Delete tmt installation for RHEL10 CI - Disable ibus-panel rich condition in RHEL - Delete ibus-xx-desktop-testing-mutter.patch - Delete libXtst-devel dependency - Replace gnome-terminal with ptyxis - Install gnome-desktop-testing for RHEL - Delete xorg-x11-server-Xvfb gnome-session-xsession - Delete build packages for gnome-desktop-testing for RHEL - Move evince gnome-logs gvfs-fuse gvfs-gphoto2 gvfs-smb to Fedora specific - Fix CI test case conditions - Add no-overview@fthx until gnome-shell-extension-no-overview is available - Add gnome-headless-session@.service until GDM will provide it - Replace GNOME Xorg with GNOME Wayland in CI - Replace STI with TMT in CI - Update CI for RHEL packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Resolves: RHEL-36638 Fix CI test - Resolves: RHEL-36633 Do not require gnome-session, gnome-shell, gnome- desktop-testing, ibus-desktop-testing, gnome-shell-extension-no-overview for the CI test - Resolves: RHEL-31506 Update to 2.25.11 - Yet another fix to make it possible again to use keys with Unicode keysyms in keybindings and make it work with all known versions of ibus (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/497) - Use NFC when doing the cursor correction after committing a preedit using space (Resolves: https://github.com/mike-fabian/ibus-typing- booster/issues/515) - Fix for ibus-1.5.30: Make it possible again to use keys with Unicode keysyms in keybindings (Resolves: https://github.com/mike-fabian/ibus- typing-booster/issues/497) - Bump release for June 2024 mass rebuild - Resolves: RHEL-36638 Update to 2.25.9 and Remove dependency on Xvfb from CI tests - Translation update from Weblate (cs 100%) - Update emoji annotations from CLDR - Drop Python < 3.6 support - Fix test_0_gtk.py: typing booster now avoids clearing the input in do_reset() when the preedit is empty - Remove dependency on Xvfb from ibus-typing-booster.spec - Support compose sequences containing ASCII keys written as <U00XX> code points (Resolves: https://github.com/mike-fabian/ibus-typing- booster/issues/510) - Translation update from Weblate (pt 91.3%) - adding gating.yaml - Resolves: RHEL-31506 Release 2.25.7 - Don’t use forward_key_event() on Gnome Wayland if the key might be a keyboard shortcut using a modifier (Resolves: https://github.com/mike- fabian/ibus-typing-booster/issues/507) - Resolves: RHEL-31506 Update to 2.25.6 - If Shift+something is pressed and then released, do not swallow the release of the Shift key (Resolves: https://github.com/mike-fabian/ibus- typing-booster/issues/504) - Decrease grid_row_spacing from 5 to 1 pixels to make the setup tool still fit on a 1024x768 pixel screen - Resolves: RHEL-31506 Update to 2.25.4 - Pass key which triggered cancel command to application if self._min_char_complete == 0 and there are no candidates (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/505) - Update emoji annotations from CLDR - Translation update from Weblate (ka 100%) - Resolves: RHEL-83888 Bump to 1.5.32 - Rebuild to export GSK_RENDERER=cairo in CentOS but not RHEL for Vulkan - Move gnome-calendar & gnome-epub-thumbnailer to Fedora specific in CI - Bump to 1.5.31 - Delete RHEL specific packages - Update installed packages in CI - configure option for Flatpak build - Move xinit post scripts - Require gnome-shell-extension-no-overview in RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Delete tmt installation for RHEL10 CI - Disable ibus-panel rich condition in RHEL - Delete ibus-xx-desktop-testing-mutter.patch - Delete libXtst-devel dependency - Replace gnome-terminal with ptyxis - Install gnome-desktop-testing for RHEL - Delete xorg-x11-server-Xvfb gnome-session-xsession - Delete build packages for gnome-desktop-testing for RHEL - Move evince gnome-logs gvfs-fuse gvfs-gphoto2 gvfs-smb to Fedora specific - Fix CI test case conditions - Add no-overview@fthx until gnome-shell-extension-no-overview is available - Add gnome-headless-session@.service until GDM will provide it - Replace GNOME Xorg with GNOME Wayland in CI - Replace STI with TMT in CI - Update CI for RHEL packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Revert to tomcat 9 - Resolves: RHEL-155406 - Rebuilt for exception target - Rebase to JSS 5.9.0 - Resolves: RHEL-150666 - Rebase to JSS 5.9.0-beta2 - Resolves RHEL-143049: Add support to ML-DSA - Rebase to JSS 5.9.0-beta1 - Resolves RHEL-143049: Add support to ML-DSA - Rebase to JSS 5.7.0 - Jira Ticket RHCS-98721 ACME server: RFC 8555 violation: Support ES256 #4638 [rhel-10] - Jira Ticket IDM-2428 build encountered: PQC alg defs to match with NSS V3.112 - Rebase to JSS 5.6.0 - Rebase to JSS 5.6.0-alpha1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 - Resolves: RHEL-54331 - Rebase to JSS 5.6.0 - Rebase to JSS 5.6.0-alpha1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 - Resolves: RHEL-54331 - Bump release for June 2024 mass rebuild - Rebase to JSS 5.5.0 - Revert to tomcat 9 - Resolves: RHEL-155406 - Rebuilt for exception target - Rebase to JSS 5.9.0 - Resolves: RHEL-150666 - Rebase to JSS 5.9.0-beta2 - Resolves RHEL-143049: Add support to ML-DSA - Rebase to JSS 5.9.0-beta1 - Resolves RHEL-143049: Add support to ML-DSA - Rebase to JSS 5.7.0 - Jira Ticket RHCS-98721 ACME server: RFC 8555 violation: Support ES256 #4638 [rhel-10] - Jira Ticket IDM-2428 build encountered: PQC alg defs to match with NSS V3.112 - Rebase to JSS 5.6.0 - Rebase to JSS 5.6.0-alpha1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 - Resolves: RHEL-54331 - Rebase to LDAP SDK 5.6.0 - Rebase to LDAP SDK 5.6.0-alpha1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 - Resolves: RHEL-54333 - Bump release for June 2024 mass rebuild - Rebase to LDAP SDK 5.5.0 - Fix build.sh to recognize AlmaLinux as RHEL-compatible - Revert to tomcat 9 - Resolves: RHEL-155406 - Rebuilt for exception target - Rebase to PKI 11.9.0 - Resolves: RHEL-150666 - Rebase to PKI 11.9.0-beta1 - Resolves: RHEL-143038 - Resolves: RHEL-79552 - Resolves: RHEL-75980 - Rebase to PKI 11.9.0-beta1 - Resolves: RHEL-143038 - Resolves: RHEL-79552 - Rebase to PKI 11.7.1 - Resolves: RHEL-76752 - Resolves: RHEL-108293 - Resolves: RHEL-27181 - Rebase to PKI 11.7.0 - Resolves: RHEL-99832 - Rebase to PKI 11.6.0 - Resolves: RHEL-70108 - Resolves: RHEL-75585 - Resolves: RHEL-75546 - Resolves: RHEL-74371 - Resolves: RHEL-63015 - update to use tomcat9 Resolves: RHEL-78038 - fix FTBFS - Fix build.sh to recognize AlmaLinux as RHEL-compatible - Update jackson bundled to 2.21.4 - Resolves: RHEL-188290 - Resolves: RHEL-190906 - Revert to tomcat 9 - Resolves: RHEL-155406 - Rebuilt for exception target - Rebase to PKI 11.9.0 - Resolves: RHEL-150666 - Rebase to PKI 11.9.0-beta1 - Resolves: RHEL-143038 - Resolves: RHEL-79552 - Resolves: RHEL-75980 - Rebase to PKI 11.9.0-beta1 - Resolves: RHEL-143038 - Resolves: RHEL-79552 - Rebase to PKI 11.7.1 - Resolves: RHEL-76752 - Resolves: RHEL-108293 - Resolves: RHEL-27181 - Rebase to PKI 11.7.0 - Resolves: RHEL-99832 - Rebase to PKI 11.6.0 - Resolves: RHEL-70108 - Resolves: RHEL-75585 - Resolves: RHEL-75546 - Resolves: RHEL-74371 - Resolves: RHEL-63015 - Fix build.sh to recognize AlmaLinux as RHEL-compatible - RHEL-245469 CVE-2026-76561 dogtag-pki: ExternalProcessConstraint executable allow-list - RHEL-248585 CVE-2026-80110 dogtag-pki: ACLFilter sort order fix - Update jackson bundled to 2.21.4 - Resolves: RHEL-188290 - Resolves: RHEL-190906 - Revert to tomcat 9 - Resolves: RHEL-155406 - Rebuilt for exception target - Rebase to PKI 11.9.0 - Resolves: RHEL-150666 - Rebase to PKI 11.9.0-beta1 - Resolves: RHEL-143038 - Resolves: RHEL-79552 - Resolves: RHEL-75980 - Rebase to PKI 11.9.0-beta1 - Resolves: RHEL-143038 - Resolves: RHEL-79552 - Rebase to PKI 11.7.1 - Resolves: RHEL-76752 - Resolves: RHEL-108293 - Resolves: RHEL-27181 - Rebase to PKI 11.7.0 - Resolves: RHEL-99832 - Fix build.sh to recognize AlmaLinux as RHEL-compatible - Update jackson bundled to 2.21.6 - Resolves: RHEL-259220 - RHEL-245469 CVE-2026-76561 dogtag-pki: ExternalProcessConstraint executable allow-list - RHEL-248585 CVE-2026-80110 dogtag-pki: ACLFilter sort order fix - Update jackson bundled to 2.21.4 - Resolves: RHEL-188290 - Resolves: RHEL-190906 - Revert to tomcat 9 - Resolves: RHEL-155406 - Rebuilt for exception target - Rebase to PKI 11.9.0 - Resolves: RHEL-150666 - Rebase to PKI 11.9.0-beta1 - Resolves: RHEL-143038 - Resolves: RHEL-79552 - Resolves: RHEL-75980 - Rebase to PKI 11.9.0-beta1 - Resolves: RHEL-143038 - Resolves: RHEL-79552 - Rebase to PKI 11.7.1 - Resolves: RHEL-76752 - Resolves: RHEL-108293 - Resolves: RHEL-27181 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to upstream release 61.0 - Fix pyverbs tests - Rebase to upstream release v57.0 - Properly check %{valgrind_arches} - Fix data corruption in bnxt_re - Update to upstream release v54.0 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Update to upstream release v51.0 - Add rhel10 gating configuration and tests - Resolves: RHEL-168516 TestIPAMigrationProdMode tests are missing - Resolves: RHEL-155027 Adding a group with 32Bit Idrange fails - Resolves: RHEL-153145 IdM password policy Min lifetime is not enforced when high minlife is set - Resolves: RHEL-166864 Include latest fixes in python3-ipatests package - Resolves: RHEL-4895 ipa use systemd-sysusers - Resolves: RHEL-146023 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None)) - Resolves: RHEL-145855 Include latest fixes in python3-ipatests package - Resolves: RHEL-88855 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'" - Resolves: RHEL-43143 ipa-advise client script requires keytab (should just require root access on client system) - Resolves: RHEL-4895 ipa use systemd-sysusers - Resolves: RHEL-4823 Names of domains from a trusted forest should be compared case-insentive - Resolves: RHEL-140587 Support replaceable WebUI artwork for RHEL and CentOS - Resolves: RHEL-113778 Command that retrieve and install new CA certificates - Resolves: RHEL-141296 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks - Resolves: RHEL-141011 Include latest fixes in python3-ipatests package - Resolves: RHEL-119339 Memory leaks in IPA plugins - Resolves: RHEL-120956 Rebase ipa to latest 4.13.x version for RHEL 10.2 - Resolves: RHEL-90121 Add modern WebUI as submodule and enable routing in Apache - Resolves: RHEL-132337 Include latest fixes in python3-ipatests package - Resolves: RHEL-129965 Fix ipatests for kdcproxy after CVE-2025-59088 fix - Resolves: RHEL-129547 Switch IPA to use the PKI python API directly rather than RPC calls - Resolves: RHEL-133342 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service - Resolves: RHEL-122767 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier - Resolves: RHEL-119628 Include fixes in python3-ipatests - Resolves: RHEL-110204 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM - Resolves: RHEL-119481 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class - Resolves: RHEL-126761 [RFE] Support storing LWCA private keys on an HSM - Resolves: RHEL-86030 [RFE] ipa-client-automount should have an option to include domain of the machine. - Resolves: RHEL-119617 test_cacert_manage fails due to expired Let's Encrypt R3 certificate - Resolves: RHEL-118446 ipa: Privilege escalation from host to domain admin in FreeIPA - Related: RHEL-114545 Rebase Samba to the latest 4.23.x release - Resolves: RHEL-109895 Revert allow update of Kerberos master key - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service - Resolves: RHEL-245626 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [rhel-10.2.z] - Resolves: RHEL-245473 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI - Resolves: RHEL-240909 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-10.2.z] - Resolves: RHEL-240842 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [rhel-10.2.z] - Resolves: RHEL-240821 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read [rhel-10.2.z] - Resolves: RHEL-240800 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read [rhel-10.2.z] - Resolves: RHEL-240768 ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z] - Resolves: RHEL-238676 ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] - Resolves: RHEL-238673 ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] - Resolves: RHEL-238526 ipa env: support only simple * wildcard [rhel-10.2.z] - Resolves: RHEL-238522 host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z] - Resolves: RHEL-238518 ipa-otptoken-import hardening [rhel-10.2.z] - Resolves: RHEL-238516 Remove NetBIOS dependencies in Identity Manager [rhel-10.2.z] - Resolves: RHEL-238510 WebUI Hardening [rhel-10.2.z] - Resolves: RHEL-218853 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL - Resolves: RHEL-173375 [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2] - Resolves: RHEL-168516 TestIPAMigrationProdMode tests are missing - Resolves: RHEL-155027 Adding a group with 32Bit Idrange fails - Resolves: RHEL-153145 IdM password policy Min lifetime is not enforced when high minlife is set - Resolves: RHEL-166864 Include latest fixes in python3-ipatests package - Resolves: RHEL-4895 ipa use systemd-sysusers - Resolves: RHEL-146023 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None)) - Resolves: RHEL-145855 Include latest fixes in python3-ipatests package - Resolves: RHEL-88855 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'" - Resolves: RHEL-43143 ipa-advise client script requires keytab (should just require root access on client system) - Resolves: RHEL-4895 ipa use systemd-sysusers - Resolves: RHEL-4823 Names of domains from a trusted forest should be compared case-insentive - Resolves: RHEL-140587 Support replaceable WebUI artwork for RHEL and CentOS - Resolves: RHEL-113778 Command that retrieve and install new CA certificates - Resolves: RHEL-141296 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks - Resolves: RHEL-141011 Include latest fixes in python3-ipatests package - Resolves: RHEL-119339 Memory leaks in IPA plugins - Resolves: RHEL-120956 Rebase ipa to latest 4.13.x version for RHEL 10.2 - Resolves: RHEL-90121 Add modern WebUI as submodule and enable routing in Apache - Resolves: RHEL-132337 Include latest fixes in python3-ipatests package - Resolves: RHEL-129965 Fix ipatests for kdcproxy after CVE-2025-59088 fix - Resolves: RHEL-129547 Switch IPA to use the PKI python API directly rather than RPC calls - Resolves: RHEL-133342 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service - Resolves: RHEL-122767 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier - Resolves: RHEL-119628 Include fixes in python3-ipatests - Resolves: RHEL-110204 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM - Resolves: RHEL-119481 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class - Resolves: RHEL-126761 [RFE] Support storing LWCA private keys on an HSM - Resolves: RHEL-86030 [RFE] ipa-client-automount should have an option to include domain of the machine. - Resolves: RHEL-119617 test_cacert_manage fails due to expired Let's Encrypt R3 certificate - Resolves: RHEL-118446 ipa: Privilege escalation from host to domain admin in FreeIPA - Related: RHEL-114545 Rebase Samba to the latest 4.23.x release - Fix JSON value bounds checks in get_parameters and iperf_parse_arguments (CVE-2026-71217) - Resolves: RHEL-236170 - Resolves: RHEL-151876 - authentication no longer works with the new openssl - Resolves: RHEL-136170 - iperf Heap Buffer Overflow (CVE-2025-54349) - Resolves: RHEL-71809 - Denial of Service in iperf Due to Improper JSON Handling - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - DoS via UDP receive worker infinite loop (CVE-2026-102253) - Resolves: RHEL-273152 - Fix JSON value bounds checks in get_parameters and iperf_parse_arguments (CVE-2026-71217) - Resolves: RHEL-236170 - Resolves: RHEL-151876 - authentication no longer works with the new openssl - Resolves: RHEL-136170 - iperf Heap Buffer Overflow (CVE-2025-54349) - Resolves: RHEL-71809 - Denial of Service in iperf Due to Improper JSON Handling - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-151876 - authentication no longer works with the new openssl - Resolves: RHEL-136170 - iperf Heap Buffer Overflow (CVE-2025-54349) - Resolves: RHEL-71809 - Denial of Service in iperf Due to Improper JSON Handling - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - New version 3.17.1 - Fixes CVE-2024-26306 - Migrated to SPDX license - Improving testing for RHEL10 - iproute-6.17.0-2.el10 - iproute-6.17.0-1.el10 - iproute-6.14.0-2.el10 - iproute-6.14.0-1.el10 - Add image-mode testing - Add tmt test plan - Fix gating yaml - iproute-6.11.0-1.el10 - Use osci.brew-build.tier0.functional as test_case_name in gating.yaml - Bump release for October 2024 mass rebuild: - Open-iSCSI upstream 2.1.11 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - iscsiuio threading fixes (iscsiuio 0.7.8.8) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - libiscsi build issues with new makefiles - Rebased to Open-iSCSI 2.1.9 - fix IQN name validation to prevent path traversal (CVE-2026-44943) - fix iscsiuio control-socket credential verification (CVE-2026-44944) - fix IQN name validation to prevent path traversal (CVE-2026-44943) - fix iscsiuio control-socket credential verification (CVE-2026-44944) - fix regression in fw and static node records - Open-iSCSI upstream 2.1.11 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add explicit requires with version on subpackage isns-utils-lib Resolves: RHEL-70744 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix double-free vulnerability in attrs.c error paths (CVE-2026-55995) Resolves: RHEL-219472 - Add explicit requires with version on subpackage isns-utils-lib Resolves: RHEL-70744 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild to force gating to use new gating config (changed genisoimage to xorriso for tests) - New Version 1.2.5 (bcl) Resolves: RHEL-45005 - testpyisomd5sum.py: Use a consistent iso size (bcl) - Remove quiet from iso creation, size seems wrong (bcl) - workflows: Move to Fedora 39 and checkout v4 (bcl) - Add support for riscv64 (davidlt) - workflows: Update to use actions/checkout (bcl) - Add a GitHub Action to run tests (bcl) - Add mips64 (wangray1021) - testpyisomd5sum.py: Support genisoimage, Python 2 (ryan) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-annotations-2.16.1 (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-annotations-2.16.0 (Tatu Saloranta) - Prepare for 2.16.0 release (Tatu Saloranta) - Improve JavaDoc of `@JsonProperty.required` (#239) (Kim, Joo Hyuk) - Bump the github-actions group with 1 update (#238) (dependabot[bot]) - Back to snapshot dep (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Resolves rhbz#2249892 - [maven-release-plugin] prepare release jackson-annotations-2.15.3 (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.15.2 - Update to version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-annotations-2.16.1 (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-annotations-2.16.0 (Tatu Saloranta) - Prepare for 2.16.0 release (Tatu Saloranta) - Improve JavaDoc of `@JsonProperty.required` (#239) (Kim, Joo Hyuk) - Bump the github-actions group with 1 update (#238) (dependabot[bot]) - Back to snapshot dep (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Resolves rhbz#2249892 - [maven-release-plugin] prepare release jackson-annotations-2.15.3 (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.15.2 - Update to version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-bom-2.16.1 (Tatu Saloranta) - Prepare for 2.16.1 release (Tatu Saloranta) - back to snapshot deps (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-bom-2.16.0 (Tatu Saloranta) - Prepare for 2.16.0 release (Tatu Saloranta) - Add version of `jackson-module-android-record` (Tatu Saloranta) - Back to snapshot deps (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Resolves rhbz#2249891 - [maven-release-plugin] prepare release jackson-bom-2.15.3 (Tatu Saloranta) - Prepare for 2.15.3 release (Tatu Saloranta) - Update `nexus-staging-maven-plugin` dep to 1.6.13 (from 1.6.8) (Tatu Saloranta) - To 2.15.3-SNAPSHOT (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.15.2 - Update to version 2.15.0 - Update to version 2.14.2 - Bump release for June 2024 mass rebuild - Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-core-2.16.1 (Tatu Saloranta) - Prepare for 2.16.1 release (Tatu Saloranta) - Minor test improvements (Tatu Saloranta) - Minor tweaking post-merge wrt #1175 (Tatu Saloranta) - Add failing tests for #1173: parse error location (#1175) (Paul Bunyan) - Backport #1168 in 2.16(.1) (Tatu Saloranta) - Update release notes wrt #1161 backport (Tatu Saloranta) - fastdoubleparser 1.0.0 (#1163) (#1166) (PJ Fanning) - Update release notes wrt #1161 (Tatu Saloranta) - fastdoubleparser 1.0.0 (#1163) (#1165) (PJ Fanning) - Tiny import clean up (Tatu Saloranta) - update javadoc to highlight that this class is for internal jackson use (#1156) (PJ Fanning) - Test code clean up: pro-actively replace to-be-deprecated methods to non-deprecated ones (wrt 2.17) (Tatu Saloranta) - Fix #1146: add missing `JsonParserDelegate` overrides (#1147) (Tatu Saloranta) - Update version scorecard check runs for (Tatu Saloranta) - Fix #1141: prevent NPE in Version.equals() (#1142) (Tatu Saloranta) - Fix typo in VERSION-2.x (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-core-2.16.0 (Tatu Saloranta) - Prepare for 2.16.0 release (Tatu Saloranta) - Make JacksonFeatureSet java.io.Serializable (Tatu Saloranta) - Update release notes wrt #1136 (Tatu Saloranta) - Change error mesage to mention -INF (#1136) (PJ Fanning) - Bump the github-actions group with 2 updates (#1134) (dependabot[bot]) - Add missing name-length check in a test (Tatu Saloranta) - Unit test cleanup (Tatu Saloranta) - Maximum Property name length affects input/read (#1130) (PJ Fanning) - Bump the github-actions group with 2 updates (#1129) (dependabot[bot]) - Back to snapshot deps (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Resolves rhbz#2249923 - [maven-release-plugin] prepare release jackson-core-2.15.3 (Tatu Saloranta) - Prepare for 2.15.3 release (Tatu Saloranta) - Update release notes wrt #1111 (Tatu Saloranta) - Call the right filterFinishArray/Object from FilteringParserDelegate (#1111) (Dai MIKURUBE) - Update Maven wrapper version (Tatu Saloranta) - Further tweaking of release notes (Tatu Saloranta) - Add ref to #943 in release-notes/VERSION-2.x (Tatu Saloranta) - 2.15.3-SNAPSHOT (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.15.2 - Update to version 2.14.2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Force the java bytecode version to java11 - [maven-release-plugin] prepare release jackson-databind-2.16.1 (Tatu Saloranta) - Prepare for 2.16.1 release (Tatu Saloranta) - Add passing test to close #3277 (#4259) (Kim, Joo Hyuk) - Add failing test for #4218 (Tatu Saloranta) - Post-merge clean up for #4229 (Tatu Saloranta) - Fix regression from #4008, optimize `ObjectNode.findValue(s)` and `findParent(s)` (#4230) (Kim, Joo Hyuk) - Minor update to release notes wrt #3133 (Tatu Saloranta) - Update release notes wrt #3133 fix (Tatu Saloranta) - Add now-passing test for #3133 (#4231) (Kim, Joo Hyuk) - Fix #4200: use annotations for delegating `@JsonCreator` (#4228) (Tatu Saloranta) - Tiny cleanup to eliminate bit of dead code (Tatu Saloranta) - Minor tweak post #4216 (Tatu Saloranta) - Allow primitive array deserializer to be captured by `DeserializerModifier` (#4219) (Kim, Joo Hyuk) - typo fix (release notes) (Tatu Saloranta) - Back to snapshot deps (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix pom file to work with java 11 - [maven-release-plugin] prepare release jackson-databind-2.16.0 (Tatu Saloranta) - Prepare for 2.16.0 release (Tatu Saloranta) - Post-commit fixes to #1770 (Tatu Saloranta) - issue-1770 - big number not returned as DecimalNode (#4191) (PJ Fanning) - minor test comment improvement (Tatu Saloranta) - Remove a test for closed issue; no plans to change behavior currently, no benefit from failing test. (Tatu Saloranta) - Update release notes wrt #4185 (Tatu Saloranta) - Fix for 4185 (#4189) (Kim, Joo Hyuk) - test cleanup (Tatu Saloranta) - Fix #4184: setCurrentValue() for empty POJO called at wrong time (#4186) (Tatu Saloranta) - Bump the github-actions group with 2 updates (#4183) (dependabot[bot]) - DeserializationContext changed to allow null (#4179) (wrongwrong) - Minor clean up (Tatu Saloranta) - Exception when deserialization of private `record` with default constructor (fix for #4175) (#4178) (Kim, Joo Hyuk) - Move test for #4175 under failing/ for 2.16 (as it's failing) (Tatu Saloranta) - Add test for #4715 in 2.15 (passing) (Tatu Saloranta) - Update release notes wrt #1172 (Tatu Saloranta) - Test `JsonView` works with `JsonCreator` (#4173) (Kim, Joo Hyuk) - Minor test improvement (Tatu Saloranta) - Create win.yml for windows CI (#4172) (PJ Fanning) - Bump the github-actions group with 2 updates (#4171) (dependabot[bot]) - Try fixing #4168 wrt linefeed diff (#4170) (Tatu Saloranta) - Back to snapshot dep (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - [maven-release-plugin] prepare release jackson-databind-2.15.3 (Tatu Saloranta) - Prepare for 2.15.3 release (Tatu Saloranta) - Minor refactoring wrt #4149 (Tatu Saloranta) - Create TestMixedCollections.java (#4149) (PJ Fanning) - Update release notes wrt #4121 (Tatu Saloranta) - Preserve the original component type in merging to the array (#4121) (Yury Molchan) - Introduce more efficient Form-Based GitHub Issue Templates (#4042) (Kim, Joo Hyuk) - Improve JavaDoc and Test for config ACCEPT_EMPTY_STRING_AS_NULL_OBJECT wrt special cases (#4012) (Kim, Joo Hyuk) - Update Maven wrapper version (Tatu Saloranta) - Minor javadoc improvement (Tatu Saloranta) - Update release notes wrt #3968 fix (Tatu Saloranta) - Ignore ConstructorDetector.SingleArgConstructor.PROPERTIES preference for Records. (#3969) (Sim Yih Tsern) - to 2.15.3-SNAPSHOT (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.15.2 - Rebase to upstream version 2.14.2 - Rebase to upstream version 2.14.2 - Rebase to upstream version 2.14.2 - Rebase to upstream version 2.14.2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-modules-base-2.16.1 (Tatu Saloranta) - Prepare for 2.16.1 release (Tatu Saloranta) - Fix #231: change OSGi dep of "activation" package to jakarta (from javax) (Tatu Saloranta) - Back to snapshot deps (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-modules-base-2.16.0 (Tatu Saloranta) - Prepare for 2.16.0 release (Tatu Saloranta) - Updated doc. Added missing test accessor. (eranl) - Minor test improvement to android module (Tatu Saloranta) - Update release notes wrt #227 (Tatu Saloranta) - Updated doc. Moved failing tests to 'failing' package. Added test for differing generic parameter types. Pruned BaseTest and BaseMapTest. Added comment about '-parameters' compiler option. (eranl) - Addressed review comments With the goal of maximizing consistency with built-in record support, I copied and "desugared" some unit tests from https://github.com/FasterXML/jackson-databind/tree/2.16/src/test-jdk17/java/com/fasterxml/jackson/databind/records. A few of the test cases are failing, and I marked them with a "Failing" comment and a "notest" name prefix. I'm hoping for guidance about whether and how I should fix them. Fixed handling of getters Added support for injected values Added use of constructor parameter names Skip module if class already has a withArgsCreator (eranl) - Add jackson-core dependency, animal-sniffer-maven-plugin, per review comments (eranl) - Add Android Record Module (eranl) - Move now passing #223 test to non-failing package (Tatu Saloranta) - Fix #223: apply check for default (interface) method in all applicable places (Tatu Saloranta) - Add test for #223: passes for Blackbird, fails for Afterburner (Tatu Saloranta) - Test #30 simplification for blackbird too (Tatu Saloranta) - Simplify test for #30 since Java 8 baseline for Jackson 2.x (Tatu Saloranta) - Remove maven-wrapper.jar (Tatu Saloranta) - Back to snapshot dep (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Resolves rhbz#2249935 - [maven-release-plugin] prepare release jackson-modules-base-2.15.3 (Tatu Saloranta) - Prepare for 2.15.3 release (Tatu Saloranta) - Udpate Maven wrapper version (Tatu Saloranta) - 2.15.3-SNAPSHOT (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.15.2 - Remove dependency on jaxb-api2 compat package - Remove dependency on jakarta-activation1 compat package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-modules-base-2.16.1 (Tatu Saloranta) - Prepare for 2.16.1 release (Tatu Saloranta) - Fix #231: change OSGi dep of "activation" package to jakarta (from javax) (Tatu Saloranta) - Back to snapshot deps (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-modules-base-2.16.0 (Tatu Saloranta) - Prepare for 2.16.0 release (Tatu Saloranta) - Updated doc. Added missing test accessor. (eranl) - Minor test improvement to android module (Tatu Saloranta) - Update release notes wrt #227 (Tatu Saloranta) - Updated doc. Moved failing tests to 'failing' package. Added test for differing generic parameter types. Pruned BaseTest and BaseMapTest. Added comment about '-parameters' compiler option. (eranl) - Addressed review comments With the goal of maximizing consistency with built-in record support, I copied and "desugared" some unit tests from https://github.com/FasterXML/jackson-databind/tree/2.16/src/test-jdk17/java/com/fasterxml/jackson/databind/records. A few of the test cases are failing, and I marked them with a "Failing" comment and a "notest" name prefix. I'm hoping for guidance about whether and how I should fix them. Fixed handling of getters Added support for injected values Added use of constructor parameter names Skip module if class already has a withArgsCreator (eranl) - Add jackson-core dependency, animal-sniffer-maven-plugin, per review comments (eranl) - Add Android Record Module (eranl) - Move now passing #223 test to non-failing package (Tatu Saloranta) - Fix #223: apply check for default (interface) method in all applicable places (Tatu Saloranta) - Add test for #223: passes for Blackbird, fails for Afterburner (Tatu Saloranta) - Test #30 simplification for blackbird too (Tatu Saloranta) - Simplify test for #30 since Java 8 baseline for Jackson 2.x (Tatu Saloranta) - Remove maven-wrapper.jar (Tatu Saloranta) - Back to snapshot dep (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Resolves rhbz#2249935 - [maven-release-plugin] prepare release jackson-modules-base-2.15.3 (Tatu Saloranta) - Prepare for 2.15.3 release (Tatu Saloranta) - Udpate Maven wrapper version (Tatu Saloranta) - 2.15.3-SNAPSHOT (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.15.2 - Remove dependency on jaxb-api2 compat package - Remove dependency on jakarta-activation1 compat package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - [maven-release-plugin] prepare release jackson-parent-2.16 (Tatu Saloranta) - Prepare for 2.16 release (Tatu Saloranta) - Update `oss-parent` dep to 56 (Tatu Saloranta) - Back to snapshot (Tatu Saloranta) - [maven-release-plugin] prepare for next development iteration (Tatu Saloranta) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to version 2.14 - Update to use SPDX licence - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebase to 2.14 Related: RHEL-30626 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for Aug 2024 java mass rebuild - Update to upstream version 1.17.0 - Put private JAR files outsides of javadir/jnidir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update to upstream version 1.16.0 - Switch from Java 17 to Java 21 - Update to upstream version 1.15.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.14.0 - Bump release for October 2024 mass rebuild: - add gating configuration - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rebase to 0.20 (rhbz#2238815) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Remove dependency on jaxb-api2 compat package - Depend on compat versions of activation and XML bind - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to version 3.5.3.Final - Rebase to version 3.5.2.Final - Rebase to version 3.5.1.Final - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Simplify and focus Summary - Remove no longer needed JDK 11 workarounds - Update jdependency to 2.8.0 (#2115425) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Simplify and focus Summary - Remove no longer needed JDK 11 workarounds - Update jdependency to 2.8.0 (#2115425) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to version 5.14.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to version 5.13.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Switch to SPDX license string - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.7.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 3.6.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.6.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 3.6.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Do not set environmental variables to prevent clashes with compilation time settings - Create /var/lib/kea through systemd-tmpfiles - Fix files owned by usbmon in image mode - Support for sending startup notifications to systemd II - New version 3.0.2 - Fixes CVE-2025-11232 - New version 3.0.1 - Fixes CVE-2025-40779 - Support for sending startup notifications to systemd - New version 3.0.0 - Remove broken keactrl in favor of systemd unit files - kea.spec: General cleanup and removal of lines that have no effect - kea-msg-compiler was moved from kea to kea-devel - New version 2.6.3 - Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803 - kea.conf: Remove /tmp/ from socket-name for existing configurations - kea.conf: Set pseudo-random password for default config to secure fresh install and allow CA startup without user intervention - kea.conf: Restrict directory permissions - Sync service files with upstream - Fix leases ownership when switching from root to kea user - Update location of fmf plans - New version 3.0.3 - Fixes CVE-2026-3608 - Do not set environmental variables to prevent clashes with compilation time settings - Create /var/lib/kea through systemd-tmpfiles - Fix files owned by usbmon in image mode - Support for sending startup notifications to systemd II - New version 3.0.2 - Fixes CVE-2025-11232 - New version 3.0.1 - Fixes CVE-2025-40779 - Support for sending startup notifications to systemd - New version 3.0.0 - Remove broken keactrl in favor of systemd unit files - kea.spec: General cleanup and removal of lines that have no effect - kea-msg-compiler was moved from kea to kea-devel - New version 2.6.3 - Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803 - kea.conf: Remove /tmp/ from socket-name for existing configurations - kea.conf: Set pseudo-random password for default config to secure fresh install and allow CA startup without user intervention - kea.conf: Restrict directory permissions - Sync service files with upstream - Fix leases ownership when switching from root to kea user - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171588 RHEL-171597 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145356 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-145358 - Improving kerberos ulog resize efficiency Resolves: RHEL-145397 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88705 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88047 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-74295 - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76758 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74373 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56058 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-71881 - Make test dependencies optional if not part of CentOS/RHEL 10 Resolves: RHEL-65724 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55427 - Fix various issues detected by static analysis Resolves: RHEL-45165 - Remove RSA protocol for PKINIT Resolves: RHEL-56070 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Do not include files with "~" termination in krb5-tests Resolves: RHEL-45995 - New upstream version (1.21.3) - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45387 RHEL-45378 - Fix memory leak in GSSAPI interface Resolves: RHEL-47284 - Fix memory leak in PMAP RPC interface Resolves: RHEL-47287 - Fix memory leak in failing UTF-8 to UTF-16 re-encoding for PAC Resolves: RHEL-47285 - Make TCP waiting time configurable Resolves: RHEL-47278 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license - Update to 1.2.80 - Resolves: RHBZ#2186606 - Port configure script to C99 (#2186199) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.79 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license - Update to 1.2.80 - Resolves: RHBZ#2186606 - Port configure script to C99 (#2186199) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.79 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license - Update to 1.2.80 - Resolves: RHBZ#2186606 - Port configure script to C99 (#2186199) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.79 - Bump release for June 2024 mass rebuild - Version 4.83 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Version 4.82a - Version 4.82 - Version 4.81 - New project URL - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Version 4.80 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Actually upload new sources - New upstream version - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.15 and switch buildsystem to meson - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Bump release for June 2024 mass rebuild - Updated to version 3.45.1 (https://sqlite.org/releaselog/3_45_1.html) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html) - List versioned soname in files, preventing unnoticed soname bumps - Disable func4 tests for i686 arch due to failing float<->int conversions - Updated to version 3.44.2 (https://sqlite.org/releaselog/3_44_2.html) - Fixes CVE-2026-11822 - Fixes CVE-2026-11824 - Resolves: RHEL-218240 - Resolves: RHEL-218275 - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.84.1 - Fix pkgconfig file regression (rhbz#2255937) - Update to 1.84.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.83.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to upstream 2.9 tarball - Update to changing SONAME (libabigail.so.8.0.0) - Simplify %check section to run both test targets in single invocation - Resolves: RHEL-121667 - Rebuild for c10s - Resolves: RHEL-102574 - Update to upstream 2.8 tarball - Remove 0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch that is applied upstream. - Update to changing SONAME (libabigail.so.7.0.0) - Add xxhash-devel as BuildRequires and inlined-xxhash to avoid depending on it at runtime - Fix CI relevant issues - Use xxhash functions inlined since xxhash is buildroot-only in RHEL 10.1 - Update to upstream 2.7 tarball - Update to changing SONAME (libabigail.so.6.0.0) - Update to upstream 2.6 tarball - Update to changing SONAME (libabigail.so.5.0.0) - Add BuildRequires xxhash-devel - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to upstream 2.5 tarball - Drop patches (as they are now upstream): 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch 0002-suppression-Add-has_strict_flexible_array_data_membe.patch - Enable abidb - Add BuildRequires: python3-devel - Add libabigail.so.4 and libabigail.so.4.0.0 to the RPM - Rebase to upstream 2.9 tarball - Update to changing SONAME (libabigail.so.8.0.0) - Simplify %check section to run both test targets in single invocation - Resolves: RHEL-121667 - Rebuild for c10s - Resolves: RHEL-102574 - Update to upstream 2.8 tarball - Remove 0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch that is applied upstream. - Update to changing SONAME (libabigail.so.7.0.0) - Add xxhash-devel as BuildRequires and inlined-xxhash to avoid depending on it at runtime - Fix CI relevant issues - Use xxhash functions inlined since xxhash is buildroot-only in RHEL 10.1 - Update to upstream 2.7 tarball - Update to changing SONAME (libabigail.so.6.0.0) - Update to upstream 2.6 tarball - Update to changing SONAME (libabigail.so.5.0.0) - Add BuildRequires xxhash-devel - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to upstream 2.5 tarball - Drop patches (as they are now upstream): 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch 0002-suppression-Add-has_strict_flexible_array_data_membe.patch - Enable abidb - Add BuildRequires: python3-devel - Add libabigail.so.4 and libabigail.so.4.0.0 to the RPM - Backport patches up to 1.6.10 - 1.6.8: bump patches up to 1.6.8 - Update to 1.6.6 with manual patching - Update to libadwaita 1.6.1 - Bump release for October 2024 mass rebuild: - Update to 1.6.0 - Bump to libadwaita-1.6-rc - Update to 1.6~alpha - Bump release for June 2024 mass rebuild - Fix various openscan issues - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebase to the latest upstream releases - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19) - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.8.2 (rhbz#2254881) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 7.8.0 (#2182540) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - AlmaLinux changes: Enable Btrfs support - lvm-dbus: Show better error for invalid LVM IDs Resolves: RHEL-123039 - Update to 3.4.0 Resolves: RHEL-114971 - Don't allow suid and dev set on fs resize Resolves: RHEL-96031 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82885 - nvme: Avoid element-type g-i annotations Resolves: RHEL-66117 - Update to 3.2.0 Resolves: RHEL-60272 Resolves: RHEL-50820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-60061 - Backport libblockdev-smart plugin Resolves: RHEL-49675 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New version - 2.10 (Vojtech Trefny) - Rename 'master' branch to 'main' (Vojtech Trefny) - remove dependency on python3-six and python2 crumbs (Alexandre Detiste) - ci: Bump actions/checkout from v3 to v4 (Vojtech Trefny) - Squashed 'translation-canary/' changes from 4d4e65b..5bb8125 (Vojtech Trefny) - dist: Fix release number in spec (Vojtech Trefny) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - New version - 2.9 (Vojtech Trefny) - build: Exit before AC_OUTPUT on error (Tomas Bzatek) - tests: fix locale tests on musl (triallax) - Update translation files (Weblate) - Translated using Weblate (Korean) (김인수) - ci: Manually prepare spec file for Packit (Vojtech Trefny) - Rebuilt for Python 3.12 - New version - 2.8 (Vojtech Trefny) - ci: Do not use release descriptions for Packit builds (Vojtech Trefny) - Do not hardcode pylint executable name in Makefile (Vojtech Trefny) - Remove unused test dependencies variables from Makefile (Vojtech Trefny) - docs: Remove information about Python 2 support (Vojtech Trefny) - Various docstring fixes (Vojtech Trefny) - Replace C++ style comments with C style (Vojtech Trefny) - Make use of error optional (Vojtech Trefny) - spec: Fix source archive URL (Vojtech Trefny) - ci: Add Packit automation for downstream builds (Vojtech Trefny) - spec: Bump release to 21 for Packit daily builds (Vojtech Trefny) - ci: Use Packit for daily builds in Copr (Vojtech Trefny) - ci: Remove GitHub action for RPM builds (Vojtech Trefny) - ci: Add Packit configuration for RPM builds on pull requests (Vojtech Trefny) - configure.ac: Remove invalid email address for bug reports (Vojtech Trefny) - ci: Update chroots for RPM builds (Vojtech Trefny) - Translated using Weblate (Kazakh) (Baurzhan Muftakhidinov) - Added translation using Weblate (Kazakh) (Baurzhan Muftakhidinov) - misc: Remove "warn: false" from Ansible "command" (Vojtech Trefny) - Translated using Weblate (Georgian) (Temuri Doghonadze) - spec: Change license string to the SPDX format required by Fedora (Vojtech Trefny) - Added translation using Weblate (Georgian) (Temuri Doghonadze) - Update translation files (Weblate) - Translated using Weblate (Korean) (김인수) - ci: Update Fedora versions for RPM build tests (Vojtech Trefny) - ci: Rename csmock.Dockerfile to ci.Dockerfile (Vojtech Trefny) - ci: Update the csmock GitHub actions configuration (Vojtech Trefny) - ci: Run rpmbuild tests in GitHub actions (Vojtech Trefny) - Add a GitHub action for running csmock static analysis (Vojtech Trefny) - README: Remove the Travis CI badge (Vojtech Trefny) - Sync spec with downstream (Vojtech Trefny) - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169302 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove unwanted subpackage captree - Bump release for June 2024 mass rebuild - Add manpages for pam_cap and capability.conf (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>) - Fix incompatibility of the build with go 1.22 (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>) - Reenable PIE in the captree tool (by Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>) - Use sbindir location provided by rpm (by Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>) - Include hardening flags by setting CGO_CFLAGS=CFLAGS and CGO_LDFLAGS=LDFLAGS - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update version to 0.11.0 ( resolves: rhbz#2262592 ) - add running of unit tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Move devel/api manpage to devel package - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 0.10.2 ( resolves: rhbz#1880885 ) - Revise specs per packaging guidelines for globs of soname - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update license to SPDX format - spec file tidy/modernization - use modern cmake build and install - properly own include directories in the devel package - de-glob some files to follow packaging guidelines - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update libcomps to 0.1.21 (RHEL-38831) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport upstream patch to fix C compatibility issue - Fix build with libxml2-2.12.0 - Update to 0.1.20 - Fixes of xml parsing - Fix non-optimized builds by removing inline keyword - Use Py_hash_t instead of long - Backport additional patch to fix segfault in fromxml_str - Backport patch to fix segfault in fromxml_str - RHEL-68430 texttopdf omits Chinese characters when creating PDF documents - RHEL-71935 Fix several important issues reported by OSH - RHEL-60322 CVE-2024-47076 libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - RHEL-26148 - fix grayscale/color raster printing via AirPrint - RHEL-29726 Backport fix for typo influencing image filtering from CMYK to CMY - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rebuilt for side-tag with libppd - RHEL-214027 CVE-2026-64611 libcupsfilters: Fix infinite loop and empty device_ids in ieee1284 - RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors via longjmp()/setjmp() to prevent process abort on malformed PNG - RHEL-68430 texttopdf omits Chinese characters when creating PDF documents - RHEL-71935 Fix several important issues reported by OSH - RHEL-60322 CVE-2024-47076 libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Additional C compatibility fixes (#2152303) - Re-enable subpackages in RHEL builds - Add convert-util subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Disable shiping libdb for rhel except convert-tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Various changes to improve C99 compatibility (#2152303) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Marked package as deprecated - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Update libdex to 0.8.1 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Avoid asm.S usage on various Linux architectures - Update to libdex 0.6.1 - Add gating.yaml via API - Update to libdex 0.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.4.3 - Bump release for sidetag rebuild - Rebase to 0.2.0 Resolves: RHEL-73467 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Initial import (#2170328) - Add 0085-libmpathpersist-fix-register-retry-status-checking.patch - Add 0086-multipathd-remember-number-of-registered-keys-when-i.patch - Add 0087-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch * Fixes RHEL-129442 ("Improve multipathd's handling of updating persistent reservations on restored paths.") - Resolves: RHEL-129442 - Add 0083-libmultipath-add-purge_disconnected-configuration-op.patch - Add 0084-multipathd-implement-purge-functionality-for-disconn.patch * Fixes RHEL-141287 ("Add purge_disconnected support to multipathd") - Resolves: RHEL-141287 - Add 0081-multipathd-make-multipathd-show-status-busy-checker-.patch * Fixes RHEL-136405 ("improve Busy checking for multipathd show status output") - Add 0082-multipathd-print-path-offline-message-even-without-a.patch * Fixes RHEL-133815 ("log_checker_err is not printing messages repeatedly for failed path [rhel-10]") - Resolves: RHEL-133815 - Resolves: RHEL-136405 - Add 0080-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch * Fixes RHEL-128338 ("Update the multipath.conf stanza for Infinidat storage") - Resolves: RHEL-128338 - Add 0078-multipathd-Fix-race-while-registering-PR-key.patch - Add 0079-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch * Fixes RHEL-118720 ("There are many bugs in multipath's persistent reservation handling [rhel-10]") - Resolves: RHEL-118720 - Add 0035-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch - Add 0036-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch - Add 0037-libmpathpersist-check-released-key-against-the-reser.patch - Add 0038-multipathd-remove-thread-from-mpath_pr_event_handle.patch - Add 0039-libmpathpersist-remove-uneeded-wrapper-function.patch - Add 0040-libmpathpersist-reduce-log-level-for-persistent-rese.patch - Add 0041-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch - Add 0042-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch - Add 0043-libmpathpersist-limit-changing-prflag-in-update_map_.patch - Add 0044-multipathd-Don-t-call-update_map_pr-unnecessarily.patch - Add 0045-libmpathpersist-remove-useless-function-send_prout_a.patch - Add 0046-libmpathpersist-redesign-failed-release-workaround.patch - Add 0047-libmpathpersist-fail-the-release-if-all-threads-fail.patch - Add 0048-libmpathpersist-Handle-changing-key-corner-case.patch - Add 0049-libmpathpersist-Handle-REGISTER-AND-IGNORE-changing-.patch - Add 0050-libmultipath-rename-prflag_value-enums.patch - Add 0051-libmpathpersist-use-a-switch-statement-for-prout-com.patch - Add 0052-libmpathpersist-Add-safety-check-for-preempting-on-k.patch - Add 0053-libmpathpersist-remove-update_map_pr-code-for-NULL-p.patch - Add 0054-libmpathpersist-move-update_map_pr-to-multipathd.patch - Add 0055-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch - Add 0056-libmpathpersist-clean-up-duplicate-function-declarat.patch - Add 0057-multipathd-wrap-setting-and-unsetting-prflag.patch - Add 0058-multipathd-unregister-PR-key-when-path-is-restored-i.patch - Add 0059-libmpathpersist-Fix-up-reservation_key-checking.patch - Add 0060-libmpathpersist-change-how-reservation-conflicts-are.patch - Add 0061-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch - Add 0062-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch - Add 0063-libmpathpersist-Restore-old-reservation-key-on-failu.patch - Add 0064-libmpathpersist-update-reservation-key-before-checki.patch - Add 0065-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch - Add 0066-libmpathpersist-Don-t-always-fail-registrations-for-.patch - Add 0067-libmpathpersist-Don-t-try-release-workaround-for-inv.patch - Add 0068-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch - Add 0069-libmpathpersist-reregister-keys-when-self-preempting.patch - Add 0070-libmpathpersist-handle-updating-key-race-condition.patch - Add 0071-libmpathpersist-handle-preempting-all-registrants-re.patch - Add 0072-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch - Add 0073-libmpathpersist-Handle-RESERVE-with-reservation-held.patch - Add 0074-libmpathpersist-use-check_holding_reservation-in-mpa.patch - Add 0075-libmpathpersist-Fix-unregistering-while-holding-the-.patch - Add 0076-libmpathpersist-Fix-race-between-restoring-a-path-an.patch - Add 0077-multipathd-Fix-tracking-of-old-PR-key.patch * Fixes RHEL-118720 ("There are many bugs in multipath's persistent reservation handling [rhel-10]") - Resolves: RHEL-118720 Add 0034-libmultipath-fix-crash-in-print_foreign_topology.patch * Fixes RHEL-107436 ("Running multipath -ll on system with "enable_foreign nvme" results in segfault") Resolves: RHEL-107436 - Add 0033-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch * Fixes RHEL-103112 ("Update multipath builtin config to add new device defaults [rhel-10]") - Resolves: RHEL-103112 - Migrate gating tests from STI to tmt - Related: RHEL-82535 - Add 0030-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch - Add 0031-libmultipath-add-helper-function-check_path_wwid_cha.patch - Add 0032-multipathd-re-add-paths-skipped-because-they-were-of.patch * Fixes RHEL-82535 ("multipathd does not monitor multipath devices created externally while there are offline paths.") - Resolves: RHEL-82535 - Add 0085-libmpathpersist-fix-register-retry-status-checking.patch - Add 0086-multipathd-remember-number-of-registered-keys-when-i.patch - Add 0087-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch * Fixes RHEL-129442 ("Improve multipathd's handling of updating persistent reservations on restored paths.") - Resolves: RHEL-129442 - Add 0083-libmultipath-add-purge_disconnected-configuration-op.patch - Add 0084-multipathd-implement-purge-functionality-for-disconn.patch * Fixes RHEL-141287 ("Add purge_disconnected support to multipathd") - Resolves: RHEL-141287 - Add 0081-multipathd-make-multipathd-show-status-busy-checker-.patch * Fixes RHEL-136405 ("improve Busy checking for multipathd show status output") - Add 0082-multipathd-print-path-offline-message-even-without-a.patch * Fixes RHEL-133815 ("log_checker_err is not printing messages repeatedly for failed path [rhel-10]") - Resolves: RHEL-133815 - Resolves: RHEL-136405 - Add 0080-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch * Fixes RHEL-128338 ("Update the multipath.conf stanza for Infinidat storage") - Resolves: RHEL-128338 - Add 0078-multipathd-Fix-race-while-registering-PR-key.patch - Add 0079-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch * Fixes RHEL-118720 ("There are many bugs in multipath's persistent reservation handling [rhel-10]") - Resolves: RHEL-118720 - Add 0035-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch - Add 0036-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch - Add 0037-libmpathpersist-check-released-key-against-the-reser.patch - Add 0038-multipathd-remove-thread-from-mpath_pr_event_handle.patch - Add 0039-libmpathpersist-remove-uneeded-wrapper-function.patch - Add 0040-libmpathpersist-reduce-log-level-for-persistent-rese.patch - Add 0041-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch - Add 0042-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch - Add 0043-libmpathpersist-limit-changing-prflag-in-update_map_.patch - Add 0044-multipathd-Don-t-call-update_map_pr-unnecessarily.patch - Add 0045-libmpathpersist-remove-useless-function-send_prout_a.patch - Add 0046-libmpathpersist-redesign-failed-release-workaround.patch - Add 0047-libmpathpersist-fail-the-release-if-all-threads-fail.patch - Add 0048-libmpathpersist-Handle-changing-key-corner-case.patch - Add 0049-libmpathpersist-Handle-REGISTER-AND-IGNORE-changing-.patch - Add 0050-libmultipath-rename-prflag_value-enums.patch - Add 0051-libmpathpersist-use-a-switch-statement-for-prout-com.patch - Add 0052-libmpathpersist-Add-safety-check-for-preempting-on-k.patch - Add 0053-libmpathpersist-remove-update_map_pr-code-for-NULL-p.patch - Add 0054-libmpathpersist-move-update_map_pr-to-multipathd.patch - Add 0055-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch - Add 0056-libmpathpersist-clean-up-duplicate-function-declarat.patch - Add 0057-multipathd-wrap-setting-and-unsetting-prflag.patch - Add 0058-multipathd-unregister-PR-key-when-path-is-restored-i.patch - Add 0059-libmpathpersist-Fix-up-reservation_key-checking.patch - Add 0060-libmpathpersist-change-how-reservation-conflicts-are.patch - Add 0061-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch - Add 0062-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch - Add 0063-libmpathpersist-Restore-old-reservation-key-on-failu.patch - Add 0064-libmpathpersist-update-reservation-key-before-checki.patch - Add 0065-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch - Add 0066-libmpathpersist-Don-t-always-fail-registrations-for-.patch - Add 0067-libmpathpersist-Don-t-try-release-workaround-for-inv.patch - Add 0068-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch - Add 0069-libmpathpersist-reregister-keys-when-self-preempting.patch - Add 0070-libmpathpersist-handle-updating-key-race-condition.patch - Add 0071-libmpathpersist-handle-preempting-all-registrants-re.patch - Add 0072-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch - Add 0073-libmpathpersist-Handle-RESERVE-with-reservation-held.patch - Add 0074-libmpathpersist-use-check_holding_reservation-in-mpa.patch - Add 0075-libmpathpersist-Fix-unregistering-while-holding-the-.patch - Add 0076-libmpathpersist-Fix-race-between-restoring-a-path-an.patch - Add 0077-multipathd-Fix-tracking-of-old-PR-key.patch * Fixes RHEL-118720 ("There are many bugs in multipath's persistent reservation handling [rhel-10]") - Resolves: RHEL-118720 Add 0034-libmultipath-fix-crash-in-print_foreign_topology.patch * Fixes RHEL-107436 ("Running multipath -ll on system with "enable_foreign nvme" results in segfault") Resolves: RHEL-107436 - Add 0033-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch * Fixes RHEL-103112 ("Update multipath builtin config to add new device defaults [rhel-10]") - Resolves: RHEL-103112 - Migrate gating tests from STI to tmt - Related: RHEL-82535 - Add 0030-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch - Add 0031-libmultipath-add-helper-function-check_path_wwid_cha.patch - Add 0032-multipathd-re-add-paths-skipped-because-they-were-of.patch * Fixes RHEL-82535 ("multipathd does not monitor multipath devices created externally while there are offline paths.") - Resolves: RHEL-82535 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libdmx 1.1.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libdmx 1.1.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for CRB inclusion Resolves: RHEL-135109 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.26.1 - Rebuilt for CRB inclusion Resolves: RHEL-135109 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.26.1 - Rework the selection of functions to represent in BTF, for instance: - Skip functions that passes values thru the stack when those structs don't have expected alignment due to some attribute usage that then causes problems with BTF trampolines due to lack of expressiveness in BTF to signal such special cases. - Skip objects (compile units) without DWARF: don't stop a multi object encoding session just because one doesn't have any DWARF in it. - Fix BTF dedup by updating libbpf. - Fix the inference of the explicit alignment attribute of zero length arrays, like struct skb_ext->data[] in the Linux kernel. Important as BTF has no no explicit alignment attribute encoding. - Fix the inference of alignments after bitfields, such as in struct nft_rule_dp->data[] after ->handle:42, also in the Linux kernel. - Fix segfault with --show_reorg_steps option, e.g. pahole -R -S -C task_struct. - Add comparision of functions encoded in BTF between baseline 'master' branch and current branch, i.e. 'next'. - New release: 1.30 - Better detection of abort during DWARF loader thread processing - pahole now detects presence of libbpf APIs and BTF features using weak function declarations when built using a shared library libbpf - Type tags are emitted for BPF arena pointers with new BTF "attributes" feature - New release: 1.29 - Multithreading is now in the DWARF loader using a jobs queue and a pool of worker threads. - The BTF encoding now is always reproducible, and as fast/faster than before. - The memory consumption is reduced. - Support for multiple BTF_DECL_TAGs pointing to same tag. - Verify that pfunct prints btf_decl_tags read from BTF. - Don't print functions twice when using 'pfunct -f function_name'. - New release: 1.28 - Various improvements to reduce the memory footprint of pahole, notably when doing BTF encoding. - Show flexible arrays statistics - Add '--padding N' and '--padding_ge N' to show structs with paddings - Introduce --running_kernel_vmlinux to find a vmlinux that matches the build-id of the running kernel. - Don't stop pfunct output at the first function that matches a filter, show all of them - Allow encoding data about all global variables, not just per CPU ones - Handle .BTF_ids section endianness, fully supporting cross builds - Generate decl tags for bpf_fastcall for eligible kfuncs - Add "distilled_base" BTF feature to split BTF generation. - Use the ELF_C_READ_MMAP mode with libelf, reducing peak memory utilization - Allow overriding /sys/kernel/btf/vmlinux via the PAHOLE_VMLINUX_BTF_FILENAME env var - Allow setting the list of compile units via PAHOLE_LANG_EXCLUDE env var - Serialize access to elfutils dwarf_getlocation(). - Honour --lang_exclude when merging LTO built CUs. - Add the debuginfod client cache directory to the vmlinux search path. - Print the CU's language when a tag isn't supported. - Initial support for GNU_formal_parameter_pack, GNU_template_parameter_pack, template_value_param and template_type_param DWARF tags. - Improve the parameter parsing by checking DW_OP_[GNU_]entry_value - Introduce a tests/ directory with regression tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Backport upstream bugfixes for clang builds Resolves: RHEL-54228 - Resolves: RHEL-45148 - Add gating.yaml - Add "Provides: pahole" - New release: v1.26 - When expanding types using 'pahole -E' do it for union and struct typedefs and for enums too. - Print number of holes, bit holes and bit paddings in class member types. - Introduce --contains_enumerator=ENUMERATOR_NAME: - Fix pretty printing using DWARF, waiting for a CU with both class (-C) and a specified "type_enum". - Add support for DW_TAG_constant in the DWARF loader, first seen in Go DWARF. - Fix loading DW_TAG_subroutine_type generated by the Go compiler. - Fix loading of 32-bit signed enums from BTF. - Add 'pahole --btf_features' to allow consumers to specify an opt-in set of features they want to use in BTF encoding. - Parallelize loading BTF and DWARF, speeding up a bit btfdiff. - Do type expansion to cover "private" types and enumerations in btfdiff. - New release: v1.27 - Reproducible parallel builds: multiple runs with different number of loading/encoding threads produce the same result. - Inject kfunc decl tags into BTF from the BTF IDs ELF section in the Linux kernel vmlinux file. - Sanitize unsupported DWARF int type with greater-than-16 byte, as BTF doesn't support it. - Initial support for BTF_KIND_DECL_TAG in the BTF loader, adding support in pfunct output. - Fix hole discovery with inheritance in C++. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix static analyzer detected issues. Resolves: RHEL-35252 - Rebase to 0.6.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.5.2 (RH#1980774) - Fix CVE-2023-22652 (RH#2212464) - Fix CVE-2023-30079 (RH#2235236) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix static analyzer detected issues. Resolves: RHEL-35252 - Rebase to 0.6.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.5.2 (RH#1980774) - Fix CVE-2023-22652 (RH#2212464) - Fix CVE-2023-30079 (RH#2235236) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.5.0 - Update to version 1.3.0 Resolves: RHEL-73468 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - libei 1.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Handle OEFFIS_DEVICE_ALL_DEVICES correctly - libei 1.2.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 0.62 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Change specfile to use SPDX identifier - Update to 0.61 - Update to 0.60 - Update to 0.59 - Update to 0.58 - version bump for -source to CRB PRP - Resolves: RHEL-94337 - fixed OSH findings - Resolves: RHEL-44360 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: licences is already SPDX compatible - BuildRequires python3-rpm-macros for pathfix.py and use the rpm macro - libevdev 1.13.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix for building for riscv64 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix tests in ELN builds (yselkowitz) - Also disable i686 in rhel>=10 (ELN failures) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Provide flex-doc via the main flex package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Analyse flex sources for license information - Migrate License field to SPDX identifiers for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 (#2222083) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Provide flex-doc via the main flex package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Analyse flex sources for license information - Migrate License field to SPDX identifiers for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 (#2222083) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Goodixmoc: Fix use-after-free when receive an incorrect CRC - Fix the goodixmoc crash in exiting callback - Update to upstream version 1.94.9 - Add PID 0x107 and 0x108 for the Synaptics fingerprint sensor - Update to upstream release 1.94.8 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Update to 1.94.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for June 2024 mass rebuild - Replace http-parser with llhttp - Update to 1.7.2 - Skip 'pack' tests on F40+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use krb5 GSSAPI - Update to 1.7.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.6.4 - Bump release for June 2024 mass rebuild - Replace http-parser with llhttp - Update to 1.7.2 - Skip 'pack' tests on F40+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use krb5 GSSAPI - Update to 1.7.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.6.4 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - ICU-22973 Fix buffer overflow by using CharString Resolves: RHEL-96667 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-59365 Fix coverity warnings - Bump release for June 2024 mass rebuild - Update to 74.2 - Update to 74.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix broken TestHebrewCalendarInTemporalLeapYear - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - fix FTBFS with GCC 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - fix FTBFS with GCC 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - libinput 1.30.1 Resolves: RHEL-136390 - libinput 1.28.1 Resolves: RHEL-126613 - Add quirks for four Dell pressure pads (RHEL-106932) - Fix negative value range for the dial to ring-mapping (RHEL-104952) - Support Wacom Intuos Pro 3rd by mapping the dial to a ring (RHEL-104952) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - libinput 1.26.1 - Bump release for June 2024 mass rebuild - libinput 1.26.0 - Mark datadir/libinput as owned by us (#2283754) - CVE-2026-50292: sanitize phys before printing it in libinput-device-group Resolves: RHEL-182371 - libinput 1.30.1 Resolves: RHEL-136390 - libinput 1.28.1 Resolves: RHEL-126613 - Add quirks for four Dell pressure pads (RHEL-106932) - Fix negative value range for the dial to ring-mapping (RHEL-104952) - Support Wacom Intuos Pro 3rd by mapping the dial to a ring (RHEL-104952) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - libinput 1.26.1 - Bump release for June 2024 mass rebuild - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack - Resolves: RHEL-25593 - Improve sssd-simple man page description - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem - Resolves: RHEL-4981 - p11_child currently has an infinite timeout - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in eval_access_token_buf() - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack - Resolves: RHEL-25593 - Improve sssd-simple man page description - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem - Resolves: RHEL-4981 - p11_child currently has an infinite timeout - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names - Resolves: RHEL-89474 - Fails to build on riscv64 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to v2.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Import v2.0.6 and regenerate documentation. - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Bump release for October 2024 mass rebuild: - New upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - New upstream release - migrated to SPDX license - Bump release for October 2024 mass rebuild: - Fixup 1.5.0 rebase - Rebase to 1.5.0 - Enable RHEL-10 CI and gating - Bump release for June 2024 mass rebuild - Bring back usage of /usr/lib64 instead of /lib64 - Remove tests from repo - Backport fixes from c9s - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 1.5.1 - Bump release for October 2024 mass rebuild: - Bump release for October 2024 mass rebuild: - Fixup 1.5.0 rebase - Rebase to 1.5.0 - Enable RHEL-10 CI and gating - Bump release for June 2024 mass rebuild - Bring back usage of /usr/lib64 instead of /lib64 - Remove tests from repo - Backport fixes from c9s - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 1.5.1 - Bump release for October 2024 mass rebuild: - Bump release for October 2024 mass rebuild: - Fixup 1.5.0 rebase - Rebase to 1.5.0 - Enable RHEL-10 CI and gating - Bump release for June 2024 mass rebuild - Bring back usage of /usr/lib64 instead of /lib64 - Remove tests from repo - Backport fixes from c9s - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 1.5.1 - Bump release for October 2024 mass rebuild: - Bump release for October 2024 mass rebuild: - Fixup 1.5.0 rebase - Rebase to 1.5.0 - Enable RHEL-10 CI and gating - Bump release for June 2024 mass rebuild - Bring back usage of /usr/lib64 instead of /lib64 - Remove tests from repo - Backport fixes from c9s - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 1.5.1 - Bump release for October 2024 mass rebuild: - Bump release for October 2024 mass rebuild: - Fixup 1.5.0 rebase - Rebase to 1.5.0 - Enable RHEL-10 CI and gating - Bump release for June 2024 mass rebuild - Bring back usage of /usr/lib64 instead of /lib64 - Remove tests from repo - Backport fixes from c9s - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 1.5.1 - Bump release for October 2024 mass rebuild: - Bump release for October 2024 mass rebuild: - Fixup 1.5.0 rebase - Rebase to 1.5.0 - Enable RHEL-10 CI and gating - Bump release for June 2024 mass rebuild - Bring back usage of /usr/lib64 instead of /lib64 - Remove tests from repo - Backport fixes from c9s - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 1.5.1 - Bump release for October 2024 mass rebuild: - Rebase to upstream 0.5.5 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add tests/ directory - Add gating.yaml to RHEL10 libkdumpfile - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - More complete Python 3 port for improved C compatibility - Update to 0.5.4 - Update to 0.5.3 - Rebase to upstream 0.5.5 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add tests/ directory - Add gating.yaml to RHEL10 libkdumpfile - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - More complete Python 3 port for improved C compatibility - Update to 0.5.4 - Update to 0.5.3 - Initial commit on c10s - Resolves: RHEL-139928 - Rebase to 1.1.3 Resolves: RHEL-127169 - Bump release for CRB inclusion Resolves: RHEL-96893 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Review fixes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Allow dropping empty json objects Resolves: RHEL-39979 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Port pcre dependency to pcre2 resolves: rhbz#2128320 - Update License tag for SPDX - Apache 2.0 was missing according to upstream sources - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix configure.ac/configure glitch (#2141801) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Update to 1.32 (RHEL-101710) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add patches for a pair of bugs that make static analysis unhappy (RHEL-38475) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.30.0 - migrate to SPDX license - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Upgrade to libmpc version 1.3.1 (rhbz#2154360) - Upgrade to libmpc version 1.3.0 (rhbz#2152180) - Convert License tags to SPDX - RHEL-45477 - Fix gating error for RHEL10 - Bump release - RHEL-45477 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - new version v0.103 - Rename libmsi.so -> libmsi-1.0.so - Fix build on s390x - More SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New release v0.102 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - RHEL-45477 - Fix gating error for RHEL10 - Bump release - RHEL-45477 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - new version v0.103 - Rename libmsi.so -> libmsi-1.0.so - Fix build on s390x - More SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New release v0.102 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to libndp 1.9 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - applied patch to fix static analysis errors https://github.com/libnet/libnet/pull/170 - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - new version - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.11.0 release - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.9.0 release - Use SPDX license identifier in package - Update to 3.8.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebase to 1.30 Resolves: RHEL-69636 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Fix build on i686 machines - New upstream release - Fix potential startup race condition (corosync use case) - Fix crypto config check - Minor API cleanup - Test suite fixes - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - Improve TX performance and use less CPU - minor other improvements - Build system update - migrated to SPDX license - Bump release for June 2024 mass rebuild - Rebase to the latest upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebase to the latest upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fix linked list corruption (RHEL-156539) - Fix gating tests for RHEL-127740 - Rebase to version 1.16.1 (RHEL-127740) - Add a fix for a NULL pointer dereference regression - bump version because the side-tag didn't propagate - Update to version 1.15 (RHEL-113070) - Update to version 1.13 (RHEL-90418) - Update to the latest version v1.11.1 (RHEL-68304) - Update to version 1.10 (RHEL-63282) - Fix RHEL-37611 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove outdated Requires: gtk2 for the pixbuf-loader (RHEL-45169) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Fix rpmautospec changelog - Update to release v1.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use libsoup 3 in ELN - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Update to 0.9.16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix description of python3-libpamtest - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update License to SPDX expression - Fix building with cmocka >= 1.1.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix description of python3-libpamtest - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update License to SPDX expression - Fix building with cmocka >= 1.1.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix description of python3-libpamtest - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update License to SPDX expression - Fix building with cmocka >= 1.1.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.8.1 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.4.1 - Update to 1.4.0 - Update to 1.3.1 - Update to 1.3.0 - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Add libpfm-ibm-counters.patch - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix gcc-14 -Werror=calloc-transposed-args compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add libpfm-monaka.patch - Add libpfm-monaka-v1.1.patch - Add libpfm-ibm-counters.patch - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Switch to use Kyoto Cabinet - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.8.1 - bug fixes - Update to 2.8.0 - bug fixes for ARMv7 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to version 1.5.7 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - update to 2.1.0 - https://github.com/pkgconf/pkgconf/blob/pkgconf-2.1.0/NEWS - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update pkgconf to 1.9.5 (#2192963) - Rebuild for ATF soname bump - Rebase to 1.9.4 - Drop dependency on system-rpm-config (#2172406) - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161329) - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161213) - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148328) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148832) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146650) - CVE-2025-64720: buffer overflow (RHEL-131432) - CVE-2025-65018: heap buffer overflow (RHEL-131445) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133216) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild for rerunning tests - fix hardening on aarch64 - fix static analysis findings (RHEL-44993) - Bump release for June 2024 mass rebuild - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148328) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148832) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146650) - CVE-2025-64720: buffer overflow (RHEL-131432) - CVE-2025-65018: heap buffer overflow (RHEL-131445) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133216) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild for rerunning tests - fix hardening on aarch64 - fix static analysis findings (RHEL-44993) - Bump release for June 2024 mass rebuild - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161329) - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161213) - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148328) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148832) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146650) - CVE-2025-64720: buffer overflow (RHEL-131432) - CVE-2025-65018: heap buffer overflow (RHEL-131445) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133216) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild for rerunning tests - fix hardening on aarch64 - fix static analysis findings (RHEL-44993) - Bump release for June 2024 mass rebuild - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148328) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148832) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146650) - CVE-2025-64720: buffer overflow (RHEL-131432) - CVE-2025-65018: heap buffer overflow (RHEL-131445) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133216) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild for rerunning tests - fix hardening on aarch64 - fix static analysis findings (RHEL-44993) - Bump release for June 2024 mass rebuild - RHEL-71942 Fix several important issues reported by OSH - RHEL-60335 CVE-2024-47175 libppd: remote command injection via attacker controlled data in PPD file - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - RHEL-52980 fix deciding page sizes by changing delta for difference - RHEL-25803 libppd - backport fix for PWG printer support - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2240389 - libppd-2.0.0 is available - CVE-2023-4504 libppd: Postscript Parsing Heap Overflow - Fix build with meson >= 1.7 (RHEL-133035) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add patches for a pair of bugs that make static analysis unhappy (RHEL-38475) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.34.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - Rebuild for the annobin fixes - Resolves: rhbz#1704058 - Rebuild for the annobin fixes - Resolves: rhbz#1704058 - Upgrade to version 2.5.6. Resolves: RHEL-80090 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - SELinux userspace 3.10 release - Rebuild to accommodate changes in swig (RHEL-138405) - SELinux userspace 3.9 release - SELinux userspace 3.9-rc2 release - SELinux userspace 3.8.1 release - improve performance of semanage store rebuild (RHEL-81707) - SELinux userspace 3.8 release - SELinux userspace 3.8-rc3 release - SELinux userspace 3.8-rc1 release - direct_api: INTEGER_OVERFLOW read_len = read() (RHEL-35997) - Bump release for October 2024 mass rebuild (RHEL-64018) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add linking of gssapi to support Kerberos authentication - Resolves: rhbz#2245095 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.3.10 - Resolves: rhbz#2211498 - Change the License tag to the SPDX format - Fix testsuite - Resolves: rhbz#2166252 - Fix multihome server handling and backport cmake support - Related: rhbz#1130328 - Update to 1.4.328.1 SDK - Update to SDK v1.4.313.0 - Update to 1.4.304.0 SDK - Bump release for October 2024 mass rebuild: - Update to 1.3.280.0 SDK - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - move yang files to avoid conflict with frr (#RHEL-43428) - Bump release for June 2024 mass rebuild - reduce build parallelism, too much breaks the build - fix license field (#RHEL-36338) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - C type-safety level downgrade due to pointer/int conversion bugs (#2256912) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to the latest available source tree, cleanup as much as we can - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix building with cmocka >= 1.1.6 - Update to version 1.4.0 * https://gitlab.com/cwrap/socket_wrapper/-/blob/socket_wrapper-1.4.0/CHANGELOG - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix building with cmocka >= 1.1.6 - Update to version 1.4.0 * https://gitlab.com/cwrap/socket_wrapper/-/blob/socket_wrapper-1.4.0/CHANGELOG - AlmaLinux changes: Set x86_64 arch as exchangeable to x86_64_v2 - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for June 2024 mass rebuild - Stricten dependencies between libsolv subpackages (RHEL-38831) - Configure gating - Set x86_64 arch as exchangeable to x86_64_v2 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178270) - Cope with integer overflow in data size arithmetics in repo_add_solv() (CVE-2026-9149) (RHEL-178267) - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository (CVE-2026-9150) (RHEL-178263) - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 20221101 version (#2139603) - update to 20240903 version and move pgk to AppStream - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - add %check (thanks to Gerd v. Egidy) Related: rhbz#2163492 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for SPDX rebuild - Related: RHEL-119484 - debugfs: byteswap dirsearch dirent buf on big endian systems Resolves: RHEL-74431 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Disable metadata_csum_seed and orphan_file features in mke2fs.conf - Rebase to new upstream - Remove stale patch from the package - Bump release for June 2024 mass rebuild - Recommends: /usr/sbin/sendmail rather than sendmail as many packages can provide a /usr/sbin/sendmail command - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack - Resolves: RHEL-25593 - Improve sssd-simple man page description - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem - Resolves: RHEL-4981 - p11_child currently has an infinite timeout - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in eval_access_token_buf() - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack - Resolves: RHEL-25593 - Improve sssd-simple man page description - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem - Resolves: RHEL-4981 - p11_child currently has an infinite timeout - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names - Resolves: RHEL-89474 - Fails to build on riscv64 - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack - Resolves: RHEL-25593 - Improve sssd-simple man page description - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem - Resolves: RHEL-4981 - p11_child currently has an infinite timeout - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in eval_access_token_buf() - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack - Resolves: RHEL-25593 - Improve sssd-simple man page description - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem - Resolves: RHEL-4981 - p11_child currently has an infinite timeout - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names - Resolves: RHEL-89474 - Fails to build on riscv64 - Upgrade to 1.10.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Upgrade to 1.9.8 - Upgrade to 1.9.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Remove transfig dependency for RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159310) - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148253) - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112523) - drop unused compat libtiff.so.5 (RHEL-85372) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix CVE-2024-7006 a null pointer dereference in tif_dirinfo (RHEL-52926) - Bump release for June 2024 mass rebuild - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189374) - make sure documentation is updated during build for CVE-2023-52355 (RHEL-178281) - reintroduce ignore option -i as it is required for tests (RHEL-185328) - backport documentation change for CVE-2023-52355 (RHEL-178281) - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159310) - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148253) - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112523) - drop unused compat libtiff.so.5 (RHEL-85372) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix CVE-2024-7006 a null pointer dereference in tif_dirinfo (RHEL-52926) - Fix CVE-2025-49133 Resolves: RHEL-96247 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Backport "tpm2: Return TPM_RC_VALUE upon decryption failure" Resolves: RHEL-52968 - Disable TPM 1.2 support, as it is not supported by RHEL. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Set license to 'BSD and TCGL' from previous 'BSD' (BZ2219548) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - reworking the tmt/fmf enablement to the form that Display systems QE use - Update to 1.0.29 and migrate to tmt test - Update to the upstream version 1.0.28 - Update to the upstream version 1.0.28 - Fix automake-1.17 issue since the release was based on automake-1.17 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating: Change the gating settings for RHEL-10 - RHEL-35520 Update to release 1.0.27 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to release 1.0.30 - reworking the tmt/fmf enablement to the form that Display systems QE use - Update to 1.0.29 and migrate to tmt test - Update to the upstream version 1.0.28 - Update to the upstream version 1.0.28 - Fix automake-1.17 issue since the release was based on automake-1.17 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - reworking the tmt/fmf enablement to the form that Display systems QE use - Update to 1.0.29 and migrate to tmt test - Update to the upstream version 1.0.28 - Update to the upstream version 1.0.28 - Fix automake-1.17 issue since the release was based on automake-1.17 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating: Change the gating settings for RHEL-10 - RHEL-35520 Update to release 1.0.27 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to release 1.0.30 - reworking the tmt/fmf enablement to the form that Display systems QE use - Update to 1.0.29 and migrate to tmt test - Update to the upstream version 1.0.28 - Update to the upstream version 1.0.28 - Fix automake-1.17 issue since the release was based on automake-1.17 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: license is already SPDX compatible - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebased to 5.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix pointer cast warning - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Pull in mingw sub-packages - Remove obsolete ldconfig scripts - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebased to 5.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix pointer cast warning - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Pull in mingw sub-packages - Remove obsolete ldconfig scripts - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebased to 5.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix pointer cast warning - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Pull in mingw sub-packages - Remove obsolete ldconfig scripts - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebased to 5.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix pointer cast warning - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Pull in mingw sub-packages - Remove obsolete ldconfig scripts - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebased to 5.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix pointer cast warning - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Pull in mingw sub-packages - Remove obsolete ldconfig scripts - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Enable building for ppc64le - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-180449) - qemu_capabilities: Always sort features in host-model CPU (RHEL-180449) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Cache expanded CPU (RHEL-180449) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-180449) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-180449) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-180449) - cpu: Introduce virCPUUpdateFeatures (RHEL-180449) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-180449) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-180449) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-180449) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-180449) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-180449) - distro: Replace old gating with tmt - esx: Track VMs by instanceUuid instead of UUID (RHEL-177479) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154553) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154553) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154553) - docs: Clarify host-model description in domain capabilities (RHEL-154553) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159912) - security: Cleanup hostdev label error logic (RHEL-159912) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159912) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159175) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159175) - conf: Refactor virHostdevIsPCIDevice (RHEL-159175) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159175) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159175) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159175) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159175) - conf: Introduce domain iommufd element (RHEL-159175) - qemu: Implement iommufd (RHEL-159175) - conf: Add iommufd fdgroup support (RHEL-159175) - qemu: Implement iommufd fdgroup (RHEL-159175) - tests: Add iommufd fdgroup test (RHEL-159175) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159175) - conf: Parse hyperv features even for host-model (RHEL-153576) - qemu: Wire up new hyperv host-model mode behavior (RHEL-153576) - test: Default to ROM type for loader (RHEL-82645) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916) - qemu_firmware: Drop support for kernel descriptors (RHEL-82645) - qemu_firmware: Drop 'nvram' local variable (RHEL-82645) - qemu_firmware: Move format=raw compat exception (RHEL-82645) - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645) - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645) - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645) - tests: Add firmware-auto-bios-rw (RHEL-82645) - tests: Add firmware-manual-bios-rw (RHEL-82645) - domain_validate: Reject read/write ROMs (RHEL-82645) - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645) - domain_validate: Reject ROMs with format other than raw (RHEL-82645) - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645) - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645) - schemas: Allow templateFormat without template path (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645) - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645) - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645) - qemu_firmware: Set templateFormat for custom paths (RHEL-82645) - qemu_firmware: Simplify handling of legacy paths (RHEL-82645) - qemu_firmware: Refactor setting NVRAM format (RHEL-82645) - qemu_firmware: Prefer template format to loader format (RHEL-82645) - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645) - qemu_firmware: Take templateFormat into account when matching (RHEL-82645) - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645) - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645) - tests: Add firmware-manual-efi-sev-snp (RHEL-82645) - tests: Add firmware-manual-efi-tdx (RHEL-82645) - qemu_firmware: ROM firmware is always in raw format (RHEL-82645) - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645) - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645) - schema: Add firmwareFeatures element for domaincaps (RHEL-82645) - conf: Add firmwareFeatures element for domaincaps (RHEL-82645) - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645) - docs: Document firmwareFeature element for domaincaps (RHEL-82645) - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645) - docs: Improvement related to firmware selection (RHEL-82645) - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645) - conf: Move type=rom default for loader to drivers (RHEL-82645) - tests: Rename custom JSON firmware descriptors (RHEL-82645) - schema: Introduce osnvram define (RHEL-82645) - conf: Parse and format varstore element (RHEL-82645) - conf: Update validation to consider varstore element (RHEL-82645) - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645) - qemu: Validate presence of uefi-vars device (RHEL-82645) - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645) - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645) - qemu_firmware: Split sanity check (RHEL-82645) - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645) - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645) - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645) - conf: Include varstore element in domcaps (RHEL-82645) - qemu: Fill in varstore element in domcaps (RHEL-82645) - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645) - qemu_firmware: Allow matching stateful ROMs (RHEL-82645) - qemu_firmware: Fill in varstore information (RHEL-82645) - qemu: Introduce varstoreDir (RHEL-82645) - qemu_firmware: Generate varstore path when necessary (RHEL-82645) - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645) - qemu: Create and delete varstore file (RHEL-82645) - security: Mark ROMs as read only when using AppArmor (RHEL-82645) - security: Handle varstore file (RHEL-82645) - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645) - qemu_command: Use uefi-vars device where appropriate (RHEL-82645) - include: Mention varstore where applicable (RHEL-82645) - virsh: Update for varstore handling (RHEL-82645) - domain_conf: initialize network hostdev private data (RHEL-151916) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351) - util: Move openning IOMMU device to viriommufd (RHEL-150351) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351) - util: Move openning VFIO device to virpci (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351) - qemuxmlconftest: Refactor host device preparation (RHEL-150351) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351) - qemu: Save IOMMUFD state into status XML (RHEL-150351) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351) - qemu_command: Extract building IOMMUFD props to function (RHEL-150351) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351) - conf: Introduce iommufd enum for domaincaps (RHEL-148135) - qemu: Fill iommufd domain capability (RHEL-148135) - tests: properly mock VFIO and IOMMU checks (RHEL-148135) - iommufd: fix FD leak in case of error (RHEL-150351) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115) - qemu: Implement support for persistent reservation migration control (RHEL-135115) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335) - Introduce support for disk operation latency histogram collection (RHEL-131335) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335) - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080) - qemu: Ignore cmp_legacy CPU flag (RHEL-148494) - Enable building for ppc64le - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245266, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' (RHEL-242547) - qemu: Remove unused 'qemuProcessRebootAllowed' (RHEL-242547) - qemu: monitor: Remove support for 'watchdog-set-action' (RHEL-242547) - qemu: Remove 'allowReboot' field (RHEL-242547) - qemu: capabilities: Retire QEMU_CAPS_SET_ACTION (RHEL-242547) - qemuProcessSetupLifecycleActions: Prepare to handle other actions (RHEL-242547) - qemuDomainModifyLifecycleActionLive: Prepare to handle other actions (RHEL-242547) - processGuestPanicEvent: Don't pass panic action via parameter (RHEL-242547) - conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' (RHEL-242547) - qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message (RHEL-242547) - qemuProcessGuestPanicEventInfo: Fold into only caller (RHEL-242547) - qemu: processGuestPanicEvent: Split individual steps under separate conditions (RHEL-242547) - Add support for keeping VM running when panic notifier is used (RHEL-242547) - qemu: Fix proper ordering of 'virtlockd' shutdown (RHEL-224982) - Add guest device info to virDomainGetGuestInfo (RHEL-243305) - qemu_agent: Introduce guest-get-devices (RHEL-243305) - qemuagenttest: Introduce GetGuestDeviceInfo test case (RHEL-243305) - qemu: Implement device info for virDomainGetGuestInfo() API (RHEL-243305) - virsh: Add support for VIR_DOMAIN_GUEST_INFO_DEVICES (RHEL-243305) - qemu: Ensure proper shutdown ordering of virtlockd/virtlogd daemons (RHEL-224982) - util: virFileChownFiles: do not follow symlinks (CVE-2026-63622) - qemu: capabilities: Apply 'capability_filters' configration option on all capabilities (RHEL-186019) - qemu: capabilities: Export 'virQEMUCapsNewCopy' outside of 'qemu_capspriv' (RHEL-186019) - qemu: Allow reuse of 'qemuProcessStartUpdateCustomCaps' (RHEL-186019) - qemu: validate: Validate VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186019) - qemu: postparse: Process VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186019) - virQEMUCapsCacheLookupDefault: Fix error message when no emulators are installed (RHEL-186019) - qemuxmlconfdata: un-symlink 'video-virtio-vga-gpu-gl' output (RHEL-186019) - qemuxmlconftest: Add 'video-virtio-vga' invocation with QEMU_CAPS_DEVICE_VIRTIO_VGA disabled (RHEL-186019) - qemuxmlconftest: Add test cases for configs asking for 'virtio-gpu-gl' or 'virtio-vga-gl' without the capability (RHEL-186019) - qemuxmlconftest: Add invocation of 'video-virtio-vga-gpu-gl' with missing caps and VIR_DOMAIN_DEF_PARSE_ABI_UPDATE (RHEL-186019) - qemustatusxml2xml: Add test case capturing virtio video device (RHEL-186019) - virDomainVideoDefFormat: Use 'virXMLFormatElement' instead of custom formatter (RHEL-186019) - conf: Add fields for recording actually-selected virtio video device (RHEL-186019) - qemuxmlconftest: Add test case for specifying 'virtio-gpu' where 'virtio-vga' would be picked (RHEL-186019) - qemuDeviceVideoGetModel: Directly return picked model (RHEL-186019) - qemu: postparse: Fill in selected virtio video frondend device in the XML (RHEL-186019) - qemuValidateDomainDeviceDefVideo: Fix checks of virtio video devices (RHEL-186019) - qemuDeviceVideoGetModel: Remove logic for selecting 'virtio' devices (RHEL-186019) - qemuDeviceVideoGetModel: Simplify by relying on checks from 'qemuValidateDomainDeviceDefVideo' (RHEL-186019) - qemu: Remove 'qemuDomainSupportsVideoVga' (RHEL-186019) - vmx: Generate correct disk target device ID for superwide SCSI (RHEL-191267) - vmx: Fix a case with 64 disks on one SCSI controller (RHEL-191267) - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-180449) - qemu_capabilities: Always sort features in host-model CPU (RHEL-180449) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Cache expanded CPU (RHEL-180449) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-180449) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-180449) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-180449) - cpu: Introduce virCPUUpdateFeatures (RHEL-180449) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-180449) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-180449) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-180449) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-180449) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-180449) - distro: Replace old gating with tmt - esx: Track VMs by instanceUuid instead of UUID (RHEL-177479) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154553) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154553) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154553) - docs: Clarify host-model description in domain capabilities (RHEL-154553) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159912) - security: Cleanup hostdev label error logic (RHEL-159912) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159912) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159175) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159175) - conf: Refactor virHostdevIsPCIDevice (RHEL-159175) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159175) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159175) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159175) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159175) - conf: Introduce domain iommufd element (RHEL-159175) - qemu: Implement iommufd (RHEL-159175) - conf: Add iommufd fdgroup support (RHEL-159175) - qemu: Implement iommufd fdgroup (RHEL-159175) - tests: Add iommufd fdgroup test (RHEL-159175) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159175) - conf: Parse hyperv features even for host-model (RHEL-153576) - qemu: Wire up new hyperv host-model mode behavior (RHEL-153576) - Enable building for ppc64le - test: Default to ROM type for loader (RHEL-82645) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916) - qemu_firmware: Drop support for kernel descriptors (RHEL-82645) - qemu_firmware: Drop 'nvram' local variable (RHEL-82645) - qemu_firmware: Move format=raw compat exception (RHEL-82645) - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645) - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645) - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645) - tests: Add firmware-auto-bios-rw (RHEL-82645) - tests: Add firmware-manual-bios-rw (RHEL-82645) - domain_validate: Reject read/write ROMs (RHEL-82645) - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645) - domain_validate: Reject ROMs with format other than raw (RHEL-82645) - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645) - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645) - schemas: Allow templateFormat without template path (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645) - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645) - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645) - qemu_firmware: Set templateFormat for custom paths (RHEL-82645) - qemu_firmware: Simplify handling of legacy paths (RHEL-82645) - qemu_firmware: Refactor setting NVRAM format (RHEL-82645) - qemu_firmware: Prefer template format to loader format (RHEL-82645) - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645) - qemu_firmware: Take templateFormat into account when matching (RHEL-82645) - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645) - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645) - tests: Add firmware-manual-efi-sev-snp (RHEL-82645) - tests: Add firmware-manual-efi-tdx (RHEL-82645) - qemu_firmware: ROM firmware is always in raw format (RHEL-82645) - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645) - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645) - schema: Add firmwareFeatures element for domaincaps (RHEL-82645) - conf: Add firmwareFeatures element for domaincaps (RHEL-82645) - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645) - docs: Document firmwareFeature element for domaincaps (RHEL-82645) - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645) - docs: Improvement related to firmware selection (RHEL-82645) - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645) - conf: Move type=rom default for loader to drivers (RHEL-82645) - tests: Rename custom JSON firmware descriptors (RHEL-82645) - schema: Introduce osnvram define (RHEL-82645) - conf: Parse and format varstore element (RHEL-82645) - conf: Update validation to consider varstore element (RHEL-82645) - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645) - qemu: Validate presence of uefi-vars device (RHEL-82645) - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645) - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645) - qemu_firmware: Split sanity check (RHEL-82645) - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645) - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645) - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645) - conf: Include varstore element in domcaps (RHEL-82645) - qemu: Fill in varstore element in domcaps (RHEL-82645) - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645) - qemu_firmware: Allow matching stateful ROMs (RHEL-82645) - qemu_firmware: Fill in varstore information (RHEL-82645) - qemu: Introduce varstoreDir (RHEL-82645) - qemu_firmware: Generate varstore path when necessary (RHEL-82645) - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645) - qemu: Create and delete varstore file (RHEL-82645) - security: Mark ROMs as read only when using AppArmor (RHEL-82645) - security: Handle varstore file (RHEL-82645) - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645) - qemu_command: Use uefi-vars device where appropriate (RHEL-82645) - include: Mention varstore where applicable (RHEL-82645) - virsh: Update for varstore handling (RHEL-82645) - domain_conf: initialize network hostdev private data (RHEL-151916) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351) - util: Move openning IOMMU device to viriommufd (RHEL-150351) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351) - util: Move openning VFIO device to virpci (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351) - qemuxmlconftest: Refactor host device preparation (RHEL-150351) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351) - qemu: Save IOMMUFD state into status XML (RHEL-150351) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351) - qemu_command: Extract building IOMMUFD props to function (RHEL-150351) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351) - conf: Introduce iommufd enum for domaincaps (RHEL-148135) - qemu: Fill iommufd domain capability (RHEL-148135) - tests: properly mock VFIO and IOMMU checks (RHEL-148135) - iommufd: fix FD leak in case of error (RHEL-150351) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115) - qemu: Implement support for persistent reservation migration control (RHEL-135115) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335) - Introduce support for disk operation latency histogram collection (RHEL-131335) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335) - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080) - qemu: Ignore cmp_legacy CPU flag (RHEL-148494) - src: Use device alias when ifname is unset in virDomainInterfaceAddresses() (RHEL-143933) - qemu: Implement support for associating iommufd to hostdev (RHEL-126346, RHEL-74202) - qemu: Introduce privateData for hostdevs (RHEL-126346, RHEL-74202) - qemu: Support per-process memory accounting for iommufd (RHEL-126346, RHEL-74202) - qemu: open VFIO FDs from libvirt backend (RHEL-126346, RHEL-74202) - qemu: open iommufd FD from libvirt backend (RHEL-126346, RHEL-74202) - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126346, RHEL-74202) - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126346, RHEL-74202) - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145769) - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145769) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145769) - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145769) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145769) - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-141820) - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-141820) - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-141820) - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-141820) - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144089) - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144089) - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144089) - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144089) - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144089) - esx: Debug URL just before opening with curl (RHEL-138300) - esx: Abstract all URL-creation code into one function (RHEL-138300) - esx: Switch to creating URLs using virURIFormat (RHEL-138300) - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-140196) - esx: URI encode inventory objects twice (RHEL-140196) - Update to upstream release 9.8.80 - Resolves: RHEL-98258 - Update to upstream release 9.8.71. - Resolves: RHEL-94484 - Fix a small memory leak and adjusted the code style. Resolves: RHEL-24810 - Add support for kernel 6.10. Resolves: RHEL-24810 - Update to upstream release 9.8.60. Resolves: RHEL-24810 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to upstream release 9.8.51 - Resolves: RHEL-24810 - Add patch for superindex full Resolves: RHEL-150332 - Bump version for rebuild Resolves: RHEL-93904 - Bump version for rebuild Resolves: RHEL-93904 - Add patch for double free Resolves: RHEL-93904 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Upgrade to 1.14.1 Resolves: RHEL-40644 - Replace yasm with nasm Resolves: RHEL-45221 - Bump release for June 2024 mass rebuild - Rearrange the dial leaders for the Intuos Pro 3rd Gen (RHEL-122812) - Rearrange the button leaders for the Intuos Pro 3rd Gen (RHEL-101873) - Add Wacom Intuos Pro 3rd Gen and newest Cintiqs (RHEL-101873) - libwacom 2.14 (RHEL-70830) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - libwacom 2.12.2 - libwacom 2.12.1 - libwacom 2.12 - libwacom 2.10.0 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport upstream fix for CVE-2023-5129 - Update to 1.3.2 - Add patch for CVE-2023-4863 ref rhbz#2238543 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.3.0 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport upstream fix for CVE-2023-5129 - Update to 1.3.2 - Add patch for CVE-2023-4863 ref rhbz#2238543 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - libxcb 1.17.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add missing README.md and libxcb-dbe - libxcb 1.16 - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Explicitly Require libxkbcommon in x11-utils for rpminspect - libxkbcommon 1.7.0 - Split the x11-utils into their own subpackage with the right requires - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libxkbcommon 1.6.0 - SPDX migration: update to SPDX license identifiers - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - libxbkcommon 1.5.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Explicitly Require libxkbcommon in x11-utils for rpminspect - libxkbcommon 1.7.0 - Split the x11-utils into their own subpackage with the right requires - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libxkbcommon 1.6.0 - SPDX migration: update to SPDX license identifiers - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - libxbkcommon 1.5.0 - New upstream release - Sync the content of main.fmf from rhel9 to rhel10 - New upstream release - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Remove build dependency on libstemmer-devel - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.1.39 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - 1.1.38 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.1.37 - Resolves: RHEL-119430 - Move libyang-devel to CRB - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - New version 2.1.148 - Bump release for June 2024 mass rebuild - Properly check valgrind arches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - DoS or arbitrary code execution via maliciously crafted LYB binary blob - Resolves: RHEL-177026 - CVE-2026-44673 - Resolves: RHEL-119430 - Move libyang-devel to CRB - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - New version 2.1.148 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Backport the patch that enables BTI on aarch64 Related: RHEL-50092 - Add the gating test from rhel-9 Related: RHEL-50092 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Drop gtest on RHEL (c9s backport) - migrate to SPDX license format - Latest upstream - Latest upstream - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS615 platform - Add LENOVO ISH firmware v5.8.0.7720 for X9-15 2025 - mediatek MT7922: update bluetooth firmware to 20260224103448 - linux-firmware: update firmware for MT7922 WiFi device - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l63: Add firmware for Cirrus CS35L63 for various Dell laptops - linux-firmware: Remove duplicate fw and Rename Lenovo ISH LNLM firmware files accordingly - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - QCA: Update Bluetooth QCA6698 firmware to 2.1.2-00069 - qcom: Update CDSP firmware for QCM6490 platform - linux-firmware: add firmware for Lontium LT8713SX DP hub - linux-firmware: qcom: sync audioreach firmwares from v1.0.2 build - qcom: update ADSP, CDSP firmware for sm8750 platform - qcom: update ADSP dtb.mbn for glymur platform - qca: Update Bluetooth WCN6750 1.1.3-00105 firmware to 1.1.3-00106 - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00659 to 2.1.0-00665 - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update beige goby firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update vangogh firmware - amdgpu: update navy flounder firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update SDMA 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update navi12 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update renoir firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update yellow carp firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - amdnpu: Restore old NPU firmware for compatibility - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - lenovo: remove obsolete ish_lnlm_53c4ffad_2a17559f.bin firmware - linux-firmware: update firmware for MT7902 BT device - linux-firmware: update firmware for MT7902 WiFi device - qcom: vpu: fix SC7280 VPU Gen2 firmware and add compatibility symlink - amdgpu: DMCUB updates for various ASICs - qcom: Update DSP firmware for qcs8300 platform - cirrus: cs35l41: Add Firmware for ASUS Zenbook Laptop using CS35L41 HDA - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - rtw89: 8851b: add format-1 for fw v0.29.41.5 with fw elements - rtw89: 8852a: add format-1 for fw v0.13.36.2 with fw elements - rtw89: 8852bt: add regd and diag_mac and update txpwr to R09 - rtw89: 8852b: update txpwr element to R43 - rtw89: 8852b: add format-2 with v0.29.29.15 and fw elements - Revert "rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2" - xe: Update GUC to v70.58.0 for LNL, BMG, PTL - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6390 hw2.0: update board-2.bin - qcom: Add gpu firmwares for Glymur chipset - amdgpu: DMCUB updates for various ASICs - qcom: vpu: add video firmware for Glymur - qcom: add QUPv3 firmware for x1e80100 platform - Bluetooth: Add symbolic links for Intel Solar JfP2/1 firmware variants - Bluetooth: Add symbolic links for Intel Solar firmware variants - Bluetooth: Add symbolic links for Intel Pulsar firmware variants - Bluetooth: Add symbolic links for Intel AX201 firmware variants - ath10k: WCN3990 hw1.0: update board-2.bin - qcom: add ADSP, CDSP firmware for glymur platform - ASoC: tas2783: Add Firmware files for tas2783A - linux-firmware: Update firmware file for Intel Solar core - mediatek MT7921: update bluetooth firmware to 20251223091725 - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673 - ath12k: WCN7850 hw2.0: update board-2.bin - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update board-2.bin - WHENCE: Correct 2 trailing whitespaces - linux-firmware: Add firmware for airoha-npu-7581 driver used for MT7990 offloading - linux-firmware: Add Dell ISH firmware for Intel panther lake systems - amdgpu: DMCUB updates for various ASICs - linux-firmware: update Aeonsemi AS21x1x firmware to 1.9.1 - rtl_nic: add firmware rtl8125cp-1 for RTL8125cp - ice: update DDP LAG package to 1.3.2.0 - cirrus: cs35l56: Add WHENCE links for 17aa233c spkid0 firmware - rtw89: 8922a: update REGD R73-R08, txpwr R46 and element of diag MAC - rtw89: 8852c: update REGD R73-R60, txpwr R82 and element of diag MAC - Update firmware for NPU PHX, STX and STX HALO - qcom: Update ADSP and add CDSP firmware for qcs6490-radxa-dragon-q6a - qcom: Remove ADSP SensorPD json for Radxa Dragon Q6A - amdgpu: DMCUB updates for various ASICs Resolves: - Update linux-firmware to latest upstream (RHEL-145527) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145527 - Update linux-firmware to latest upstream (RHEL-119866) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 Resolves: RHEL-119866 - Fix random hangs of Dell Pro Max laptops when on battery power (RHEL-117675) - AMDGPU: Update firmware for Strix Halo (RHEL-104078) - AMDGPU: Add firmware for Gorgon Point (RHEL-107606) - Update linux-firmware to latest upstream Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-117675, RHEL-104078, RHEL-107606 - Update linux-firmware to latest upstream (RHEL-108921) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core Resolves: RHEL-108921 - nvidia-gpu-firmware was missing firmware/nvidia/ad10{3,4,6,7} directories (RHEL-95393) - Resume after suspend-to-ram did not restore screen on some AMD GPUs (RHEL-100947) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Add fan_control v203.0.0.0 for BMG - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95393, RHEL-100947 - 1.3.41.0 DDP firmware does not support QS silicon E825C nics (RHEL-92555) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops Resolves: RHEL-92555 - accel: NPU: Update linux-firmware to include firmware for device (RHEL-85120) - Add amdnpu linux firmware folder (RHEL-77950) - Introduce new PMF TA (RHEL-86837) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-85120, RHEL-77950, RHEL-86837 - accel: ivpu: Update firmware for NPU (RHEL-38586) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38586 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-154363) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - nxp: add firmware for IW61x WiFi device - mediatek MT7922: update bluetooth firmware to 20260605203811 - mediatek MT7925: update bluetooth firmware to 20260605184935 - linux-firmware: update firmware for MT7925 WiFi device - linux-firmware: update firmware for MT7922 WiFi device - amdgpu: DMCUB updates for various ASICs - qcom: add LPAICP firmware for shikra platform - qcom: Add qdsp6sw firmware for shikra platform - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7996 - linux-firmware: update firmware for MT7992 - linux-firmware: update firmware for MT7990 - qcom: Update ADSP firmware for Kaanapali platform - qcom: update ADSP firmware for glymur platform - qcom: update CDSP firmware for glymur platform - QCA: Add bluetooth firmware nvm files for USI/NFA725B - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Scorpius core - qcom: update ADSP firmware for qcs615 platform - cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Dell laptops - rtl_bt: Update RTL8852A BT USB firmware to 0x244F_91B6 - realtek: rt1321: Update the patch code to v1.10 - amdgpu: DMCUB updates for various ASICs - QCA: Update Bluetooth WCN3950 firmware 1.3.0-00108 to 1.3.0-00184 - qcom: update CDSP firmware for shikra platform - qcom: Update ADSP firmware for Glymur platform - Remove any files with unknown licenses - AGENTS.md, README: address second round of MR review - README: document AI assisted contribution convention - AGENTS.md: clarify areas raised in MR review - Add AGENTS.md for AI coding agents - LICENSES: update GPL-2.0 text and references - LICENSES: rename GPL-3 to GPL-3.0-only - LICENSES: rename Apache-2 to Apache-2.0 - Move firmware licenses to a LICENSES/ directory - qcom: update ADSP firmware for sm8750 platform - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00666 to 2.1.0-00669 - qcom: Update DSP firmware for qcs8300 platform - qcom: Update DSP firmware for sa8775p platform - amdgpu: Update DMCUB fw for DCN314 - amdgpu: revert yellow carp VCN firmware - amdgpu: revert vangogh VCN firmware - amdgpu: revert sienna cichlid VCN firmware - amdgpu: revert navy flounder VCN firmware - amdgpu: revert dimgrey cavefish VCN firmware - amdgpu: revert beige_goby VCN firmware - qcom: update CDSP firmware for x1e80100 platform - cirrus: cs35l56: Add firmware for Cirrus Amps for a Dell laptop - linux-firmware: Add RCA firmware files for tas257x projects - intel_vpu: Update NPU firmware - cirrus: cs35l63: Add Cirrus CS35L63 firmware mappings for various Dell laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for a couple of Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for a Lenovo laptop - QCA: Add BCS calibration binary for QCC2072 - QCA: Update Bluetooth firmware for QCC2072 UART interface - amdgpu: DMCUB updates for various ASICs - rtl_nic: add firmware rtl8261c.bin for RTL8261c - cirrus: cs35l56: Add Cirrus CS35L56 firmware mappings for two Dell laptops - i915: Xe3LPD DMC v2.36 - i915: Xe3LPD_3002 DMC v2.31 - i915: Xe3p_LPD DMC v2.37 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - qcom: Add gpu firmwares for Shikra chipset - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - rtw89: 8852b: update fw to v0.29.29.18 - rtw89: 8852bt: update fw to v0.29.122.2 - amdgpu: Update gc 11.0.1 microcode - ASoC: tas2783: Add Firmware files for tas2783A projects - linux-firmware: add firmware for MT7927 WiFi device - Add HP ISH firmware for Intel Panther Lake systems - ti: Add PCM6240 firmware with multiple audio profiles support - qcom: add CDSP firmware for shikra platform - amdgpu: DMCUB updates for various ASICs - qcom: update ADSP firmware for x1e80100 platform - lt*_fw.bin: move to Lontium subdir - qcom: Add cdsp1r.jsn for sa8775p platform - amdgpu: rembrandt DMCUB v4.0.74.0 Resolves: RHEL-154363 - Update linux-firmware to latest upstream (RHEL-154363) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - linux-firmware: Add firmware for Lontium LT9611C - xe: Update GUC to v70.65.0 for LNL, BMG, PTL - amdgpu: update SMU 14.0.3 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update green sardine firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update SDMA 4.4.4 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update SDMA 4.4.5 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update VPE 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update SDMA 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update renoir firmware - amdgpu: update aldebaran firmware - rtl_bt: Add missing rtl8761a_config.bin for RTL8761AU - amdgpu: DMCUB updates for various ASICs - Linux-firmware: Add Dell ISH firmware 581.7783.0 for Intel Panther Lake systems. - qcom: update ADSP firmware for x1e80100 platform - linux-firmware:Add firmware for Lontium LT7911EXC bridge - qcom/x1e80100/dell: mark that qcom/NOTICE.txt is applicable too - qcom: Update CDSP firmware for Kaanapali platform - qcom: vpu: add Gen2 firmware binary for Agatti - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Update ADSP firmware for Glymur platform - mediatek MT7925: update bluetooth firmware to 20260414153243 - linux-firmware: update firmware for MT7925 WiFi device - Revert "linux-firmware: Update firmware file for Intel Quasar core" - qcom: Add gpdspr.jsn for qcs8300 platform - ath12k: QCC2072 hw1.0: add to WLAN.COL.1.0.c2-00074-QCACOLSWPL_V1_TO_SILICONZ-1 - ath12k: QCC2072 hw1.0: add board-2.bin - ath12k: IPQ5424 hw1.0: add to WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 - ath12k: IPQ5424 hw1.0: add board-2.bin - qcom: Update ADSP firmware for Kaanapali platform - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops (17aa235c 17aa235d) - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00665 to 2.1.0-00666 - amdgpu: DMCUB updates for DCN36 - linux-firmware: Update AMD cpu microcode - powervr: update Imagination Rogue firmware images - qcom: Update ADSP firmware for Kaanapali platform - i915: Xe3LPD DMC v2.34 - i915: Xe3LPD_3002 DMC v2.29 - qcom: Update ADSP firmware for QCM6490 platform - firmware/amdgpu: Update DMCUB fw to Release 0.1.55.0 - mediatek: vpu: drop old sym link - amdgpu: Revert Yellow Carp DMUB fw to 0x4000045 - linux-firmware: qcom: sync audioreach firmwares from v1.0.3 build - qcom: consolidate audioreach-tplg firmwares into one location in WHENCE - WHENCE: Fix ISH firmware symlink prefix for Lenovo PTL systems - intel_vpu: Update NPU firmware - Revert "rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673" - nvidia: add acr/bl symlink for booting GSP-RM on GA100 - qcom: add QUPv3 firmware for shikra - xe: Update GUC to v70.60.0 for LNL, BMG, PTL - qcom: update ADSP firmware for sm8750 platform - qcom: update CDSP firmware for glymur platform - cirrus: cs35l41: Add support for new HP laptops - cirrus: cs35l41: Add support for new ASUS laptops - cirrus: cs35l41: Add support for ASUS GZ302EAC and add 15.5dB bincfg - WHENCE: Move Dell remoteproc firmware to correct section - qcom: vpu: add video firmware for SM8450 - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - iwlwifi: add Bz/Sc FW for core103-40 release - iwlwifi: Add Hr/Gf firmware for core103-40 release - iwlwifi: update ty/So/Ma firmwares for core103-40 release - amdgpu: DMCUB updates for various ASICs - xe: Update PTL GSC to v105.0.2.1397 - linux-firmware: add firmware for Moxa mux50u devices - rtl_bt: Update RTL8852B BT USB FW to 0x127C_FD78 - ath11k: WCN6855 hw2.0@nfa765: update to WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - linux-firmware: update firmware for qat_4xxx devices - linux-firmware: update firmware for qat_402xx devices - linux-firmware: update firmware for qat_420xx devices - linux-firmware: update firmware for an8811hb 2.5G ethernet phy - linux-firmware: qcom: Add FW blobs for DELL XPS13 9345 - amdgpu: DMCUB updates for various ASICs - cirrus: cs35l63: Update firmware for Cirrus Amps for some Dell laptops - cirrus: cs35l63: Fix Cirrus Amp firmware links for some Dell laptops - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - iwlwifi: add Bz/Wh FW for core102-56 release - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 - mediatek MT7921: update bluetooth firmware to 20260224111243 - mediatek MT7920: update bluetooth firmware to 20260224111231 - Add LENOVO ISH firmware v5.8.1.7720 for X1 Carbon (Gen 14) and X1 2-in-1 (Gen 11) - linux-firmware: Add ISH firmware file for Intel Wildcat Lake platform - linux-firmware: update firmware for MT7920 WiFi device - linux-firmware: update firmware for MT7921 WiFi device - linux-firmware: Update firmware file for Intel Quasar core - Intel Bluetooth: Update firmware file for Intel Bluetooth AX201 - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS615 platform - Add LENOVO ISH firmware v5.8.0.7720 for X9-15 2025 - mediatek MT7922: update bluetooth firmware to 20260224103448 - linux-firmware: update firmware for MT7922 WiFi device - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l63: Add firmware for Cirrus CS35L63 for various Dell laptops - linux-firmware: Remove duplicate fw and Rename Lenovo ISH LNLM firmware files accordingly - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - QCA: Update Bluetooth QCA6698 firmware to 2.1.2-00069 - qcom: Update CDSP firmware for QCM6490 platform - linux-firmware: add firmware for Lontium LT8713SX DP hub - linux-firmware: qcom: sync audioreach firmwares from v1.0.2 build - qcom: update ADSP, CDSP firmware for sm8750 platform - qcom: update ADSP dtb.mbn for glymur platform - qca: Update Bluetooth WCN6750 1.1.3-00105 firmware to 1.1.3-00106 - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00659 to 2.1.0-00665 - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update beige goby firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update vangogh firmware - amdgpu: update navy flounder firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update SDMA 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update navi12 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update renoir firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update yellow carp firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - amdnpu: Restore old NPU firmware for compatibility - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - lenovo: remove obsolete ish_lnlm_53c4ffad_2a17559f.bin firmware - linux-firmware: update firmware for MT7902 BT device - linux-firmware: update firmware for MT7902 WiFi device - qcom: vpu: fix SC7280 VPU Gen2 firmware and add compatibility symlink - amdgpu: DMCUB updates for various ASICs - qcom: Update DSP firmware for qcs8300 platform - cirrus: cs35l41: Add Firmware for ASUS Zenbook Laptop using CS35L41 HDA - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - rtw89: 8851b: add format-1 for fw v0.29.41.5 with fw elements - rtw89: 8852a: add format-1 for fw v0.13.36.2 with fw elements - rtw89: 8852bt: add regd and diag_mac and update txpwr to R09 - rtw89: 8852b: update txpwr element to R43 - rtw89: 8852b: add format-2 with v0.29.29.15 and fw elements - Revert "rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2" - xe: Update GUC to v70.58.0 for LNL, BMG, PTL - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6390 hw2.0: update board-2.bin - qcom: Add gpu firmwares for Glymur chipset - amdgpu: DMCUB updates for various ASICs - qcom: vpu: add video firmware for Glymur - qcom: add QUPv3 firmware for x1e80100 platform - Bluetooth: Add symbolic links for Intel Solar JfP2/1 firmware variants - Bluetooth: Add symbolic links for Intel Solar firmware variants - Bluetooth: Add symbolic links for Intel Pulsar firmware variants - Bluetooth: Add symbolic links for Intel AX201 firmware variants - ath10k: WCN3990 hw1.0: update board-2.bin - qcom: add ADSP, CDSP firmware for glymur platform - ASoC: tas2783: Add Firmware files for tas2783A - linux-firmware: Update firmware file for Intel Solar core - mediatek MT7921: update bluetooth firmware to 20251223091725 - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673 - ath12k: WCN7850 hw2.0: update board-2.bin - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update board-2.bin - WHENCE: Correct 2 trailing whitespaces - linux-firmware: Add firmware for airoha-npu-7581 driver used for MT7990 offloading - linux-firmware: Add Dell ISH firmware for Intel panther lake systems - amdgpu: DMCUB updates for various ASICs - linux-firmware: update Aeonsemi AS21x1x firmware to 1.9.1 - rtl_nic: add firmware rtl8125cp-1 for RTL8125cp - ice: update DDP LAG package to 1.3.2.0 - cirrus: cs35l56: Add WHENCE links for 17aa233c spkid0 firmware - rtw89: 8922a: update REGD R73-R08, txpwr R46 and element of diag MAC - rtw89: 8852c: update REGD R73-R60, txpwr R82 and element of diag MAC - Update firmware for NPU PHX, STX and STX HALO - qcom: Update ADSP and add CDSP firmware for qcs6490-radxa-dragon-q6a - qcom: Remove ADSP SensorPD json for Radxa Dragon Q6A - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-154363 - Update linux-firmware to latest upstream (RHEL-145527) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145527 - Update linux-firmware to latest upstream (RHEL-119866) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 Resolves: RHEL-119866 - Fix random hangs of Dell Pro Max laptops when on battery power (RHEL-117675) - AMDGPU: Update firmware for Strix Halo (RHEL-104078) - AMDGPU: Add firmware for Gorgon Point (RHEL-107606) - Update linux-firmware to latest upstream Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-117675, RHEL-104078, RHEL-107606 - Update linux-firmware to latest upstream (RHEL-108921) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core Resolves: RHEL-108921 - nvidia-gpu-firmware was missing firmware/nvidia/ad10{3,4,6,7} directories (RHEL-95393) - Resume after suspend-to-ram did not restore screen on some AMD GPUs (RHEL-100947) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Add fan_control v203.0.0.0 for BMG - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95393, RHEL-100947 - 1.3.41.0 DDP firmware does not support QS silicon E825C nics (RHEL-92555) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops Resolves: RHEL-92555 - accel: NPU: Update linux-firmware to include firmware for device (RHEL-85120) - Add amdnpu linux firmware folder (RHEL-77950) - Introduce new PMF TA (RHEL-86837) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-85120, RHEL-77950, RHEL-86837 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-154363) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - nxp: add firmware for IW61x WiFi device - mediatek MT7922: update bluetooth firmware to 20260605203811 - mediatek MT7925: update bluetooth firmware to 20260605184935 - linux-firmware: update firmware for MT7925 WiFi device - linux-firmware: update firmware for MT7922 WiFi device - amdgpu: DMCUB updates for various ASICs - qcom: add LPAICP firmware for shikra platform - qcom: Add qdsp6sw firmware for shikra platform - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7996 - linux-firmware: update firmware for MT7992 - linux-firmware: update firmware for MT7990 - qcom: Update ADSP firmware for Kaanapali platform - qcom: update ADSP firmware for glymur platform - qcom: update CDSP firmware for glymur platform - QCA: Add bluetooth firmware nvm files for USI/NFA725B - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Scorpius core - qcom: update ADSP firmware for qcs615 platform - cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Dell laptops - rtl_bt: Update RTL8852A BT USB firmware to 0x244F_91B6 - realtek: rt1321: Update the patch code to v1.10 - amdgpu: DMCUB updates for various ASICs - QCA: Update Bluetooth WCN3950 firmware 1.3.0-00108 to 1.3.0-00184 - qcom: update CDSP firmware for shikra platform - qcom: Update ADSP firmware for Glymur platform - Remove any files with unknown licenses - AGENTS.md, README: address second round of MR review - README: document AI assisted contribution convention - AGENTS.md: clarify areas raised in MR review - Add AGENTS.md for AI coding agents - LICENSES: update GPL-2.0 text and references - LICENSES: rename GPL-3 to GPL-3.0-only - LICENSES: rename Apache-2 to Apache-2.0 - Move firmware licenses to a LICENSES/ directory - qcom: update ADSP firmware for sm8750 platform - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00666 to 2.1.0-00669 - qcom: Update DSP firmware for qcs8300 platform - qcom: Update DSP firmware for sa8775p platform - amdgpu: Update DMCUB fw for DCN314 - amdgpu: revert yellow carp VCN firmware - amdgpu: revert vangogh VCN firmware - amdgpu: revert sienna cichlid VCN firmware - amdgpu: revert navy flounder VCN firmware - amdgpu: revert dimgrey cavefish VCN firmware - amdgpu: revert beige_goby VCN firmware - qcom: update CDSP firmware for x1e80100 platform - cirrus: cs35l56: Add firmware for Cirrus Amps for a Dell laptop - linux-firmware: Add RCA firmware files for tas257x projects - intel_vpu: Update NPU firmware - cirrus: cs35l63: Add Cirrus CS35L63 firmware mappings for various Dell laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for a couple of Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for a Lenovo laptop - QCA: Add BCS calibration binary for QCC2072 - QCA: Update Bluetooth firmware for QCC2072 UART interface - amdgpu: DMCUB updates for various ASICs - rtl_nic: add firmware rtl8261c.bin for RTL8261c - cirrus: cs35l56: Add Cirrus CS35L56 firmware mappings for two Dell laptops - i915: Xe3LPD DMC v2.36 - i915: Xe3LPD_3002 DMC v2.31 - i915: Xe3p_LPD DMC v2.37 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - qcom: Add gpu firmwares for Shikra chipset - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - rtw89: 8852b: update fw to v0.29.29.18 - rtw89: 8852bt: update fw to v0.29.122.2 - amdgpu: Update gc 11.0.1 microcode - ASoC: tas2783: Add Firmware files for tas2783A projects - linux-firmware: add firmware for MT7927 WiFi device - Add HP ISH firmware for Intel Panther Lake systems - ti: Add PCM6240 firmware with multiple audio profiles support - qcom: add CDSP firmware for shikra platform - amdgpu: DMCUB updates for various ASICs - qcom: update ADSP firmware for x1e80100 platform - lt*_fw.bin: move to Lontium subdir - qcom: Add cdsp1r.jsn for sa8775p platform - amdgpu: rembrandt DMCUB v4.0.74.0 Resolves: RHEL-154363 - Update linux-firmware to latest upstream (RHEL-154363) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - linux-firmware: Add firmware for Lontium LT9611C - xe: Update GUC to v70.65.0 for LNL, BMG, PTL - amdgpu: update SMU 14.0.3 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update green sardine firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update SDMA 4.4.4 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update SDMA 4.4.5 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update VPE 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update SDMA 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update renoir firmware - amdgpu: update aldebaran firmware - rtl_bt: Add missing rtl8761a_config.bin for RTL8761AU - amdgpu: DMCUB updates for various ASICs - Linux-firmware: Add Dell ISH firmware 581.7783.0 for Intel Panther Lake systems. - qcom: update ADSP firmware for x1e80100 platform - linux-firmware:Add firmware for Lontium LT7911EXC bridge - qcom/x1e80100/dell: mark that qcom/NOTICE.txt is applicable too - qcom: Update CDSP firmware for Kaanapali platform - qcom: vpu: add Gen2 firmware binary for Agatti - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Update ADSP firmware for Glymur platform - mediatek MT7925: update bluetooth firmware to 20260414153243 - linux-firmware: update firmware for MT7925 WiFi device - Revert "linux-firmware: Update firmware file for Intel Quasar core" - qcom: Add gpdspr.jsn for qcs8300 platform - ath12k: QCC2072 hw1.0: add to WLAN.COL.1.0.c2-00074-QCACOLSWPL_V1_TO_SILICONZ-1 - ath12k: QCC2072 hw1.0: add board-2.bin - ath12k: IPQ5424 hw1.0: add to WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 - ath12k: IPQ5424 hw1.0: add board-2.bin - qcom: Update ADSP firmware for Kaanapali platform - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops (17aa235c 17aa235d) - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00665 to 2.1.0-00666 - amdgpu: DMCUB updates for DCN36 - linux-firmware: Update AMD cpu microcode - powervr: update Imagination Rogue firmware images - qcom: Update ADSP firmware for Kaanapali platform - i915: Xe3LPD DMC v2.34 - i915: Xe3LPD_3002 DMC v2.29 - qcom: Update ADSP firmware for QCM6490 platform - firmware/amdgpu: Update DMCUB fw to Release 0.1.55.0 - mediatek: vpu: drop old sym link - amdgpu: Revert Yellow Carp DMUB fw to 0x4000045 - linux-firmware: qcom: sync audioreach firmwares from v1.0.3 build - qcom: consolidate audioreach-tplg firmwares into one location in WHENCE - WHENCE: Fix ISH firmware symlink prefix for Lenovo PTL systems - intel_vpu: Update NPU firmware - Revert "rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673" - nvidia: add acr/bl symlink for booting GSP-RM on GA100 - qcom: add QUPv3 firmware for shikra - xe: Update GUC to v70.60.0 for LNL, BMG, PTL - qcom: update ADSP firmware for sm8750 platform - qcom: update CDSP firmware for glymur platform - cirrus: cs35l41: Add support for new HP laptops - cirrus: cs35l41: Add support for new ASUS laptops - cirrus: cs35l41: Add support for ASUS GZ302EAC and add 15.5dB bincfg - WHENCE: Move Dell remoteproc firmware to correct section - qcom: vpu: add video firmware for SM8450 - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - iwlwifi: add Bz/Sc FW for core103-40 release - iwlwifi: Add Hr/Gf firmware for core103-40 release - iwlwifi: update ty/So/Ma firmwares for core103-40 release - amdgpu: DMCUB updates for various ASICs - xe: Update PTL GSC to v105.0.2.1397 - linux-firmware: add firmware for Moxa mux50u devices - rtl_bt: Update RTL8852B BT USB FW to 0x127C_FD78 - ath11k: WCN6855 hw2.0@nfa765: update to WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - linux-firmware: update firmware for qat_4xxx devices - linux-firmware: update firmware for qat_402xx devices - linux-firmware: update firmware for qat_420xx devices - linux-firmware: update firmware for an8811hb 2.5G ethernet phy - linux-firmware: qcom: Add FW blobs for DELL XPS13 9345 - amdgpu: DMCUB updates for various ASICs - cirrus: cs35l63: Update firmware for Cirrus Amps for some Dell laptops - cirrus: cs35l63: Fix Cirrus Amp firmware links for some Dell laptops - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - iwlwifi: add Bz/Wh FW for core102-56 release - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 - mediatek MT7921: update bluetooth firmware to 20260224111243 - mediatek MT7920: update bluetooth firmware to 20260224111231 - Add LENOVO ISH firmware v5.8.1.7720 for X1 Carbon (Gen 14) and X1 2-in-1 (Gen 11) - linux-firmware: Add ISH firmware file for Intel Wildcat Lake platform - linux-firmware: update firmware for MT7920 WiFi device - linux-firmware: update firmware for MT7921 WiFi device - linux-firmware: Update firmware file for Intel Quasar core - Intel Bluetooth: Update firmware file for Intel Bluetooth AX201 - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS615 platform - Add LENOVO ISH firmware v5.8.0.7720 for X9-15 2025 - mediatek MT7922: update bluetooth firmware to 20260224103448 - linux-firmware: update firmware for MT7922 WiFi device - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l63: Add firmware for Cirrus CS35L63 for various Dell laptops - linux-firmware: Remove duplicate fw and Rename Lenovo ISH LNLM firmware files accordingly - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - QCA: Update Bluetooth QCA6698 firmware to 2.1.2-00069 - qcom: Update CDSP firmware for QCM6490 platform - linux-firmware: add firmware for Lontium LT8713SX DP hub - linux-firmware: qcom: sync audioreach firmwares from v1.0.2 build - qcom: update ADSP, CDSP firmware for sm8750 platform - qcom: update ADSP dtb.mbn for glymur platform - qca: Update Bluetooth WCN6750 1.1.3-00105 firmware to 1.1.3-00106 - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00659 to 2.1.0-00665 - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update beige goby firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update vangogh firmware - amdgpu: update navy flounder firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update SDMA 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update navi12 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update renoir firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update yellow carp firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - amdnpu: Restore old NPU firmware for compatibility - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - lenovo: remove obsolete ish_lnlm_53c4ffad_2a17559f.bin firmware - linux-firmware: update firmware for MT7902 BT device - linux-firmware: update firmware for MT7902 WiFi device - qcom: vpu: fix SC7280 VPU Gen2 firmware and add compatibility symlink - amdgpu: DMCUB updates for various ASICs - qcom: Update DSP firmware for qcs8300 platform - cirrus: cs35l41: Add Firmware for ASUS Zenbook Laptop using CS35L41 HDA - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - rtw89: 8851b: add format-1 for fw v0.29.41.5 with fw elements - rtw89: 8852a: add format-1 for fw v0.13.36.2 with fw elements - rtw89: 8852bt: add regd and diag_mac and update txpwr to R09 - rtw89: 8852b: update txpwr element to R43 - rtw89: 8852b: add format-2 with v0.29.29.15 and fw elements - Revert "rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2" - xe: Update GUC to v70.58.0 for LNL, BMG, PTL - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6390 hw2.0: update board-2.bin - qcom: Add gpu firmwares for Glymur chipset - amdgpu: DMCUB updates for various ASICs - qcom: vpu: add video firmware for Glymur - qcom: add QUPv3 firmware for x1e80100 platform - Bluetooth: Add symbolic links for Intel Solar JfP2/1 firmware variants - Bluetooth: Add symbolic links for Intel Solar firmware variants - Bluetooth: Add symbolic links for Intel Pulsar firmware variants - Bluetooth: Add symbolic links for Intel AX201 firmware variants - ath10k: WCN3990 hw1.0: update board-2.bin - qcom: add ADSP, CDSP firmware for glymur platform - ASoC: tas2783: Add Firmware files for tas2783A - linux-firmware: Update firmware file for Intel Solar core - mediatek MT7921: update bluetooth firmware to 20251223091725 - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673 - ath12k: WCN7850 hw2.0: update board-2.bin - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update board-2.bin - WHENCE: Correct 2 trailing whitespaces - linux-firmware: Add firmware for airoha-npu-7581 driver used for MT7990 offloading - linux-firmware: Add Dell ISH firmware for Intel panther lake systems - amdgpu: DMCUB updates for various ASICs - linux-firmware: update Aeonsemi AS21x1x firmware to 1.9.1 - rtl_nic: add firmware rtl8125cp-1 for RTL8125cp - ice: update DDP LAG package to 1.3.2.0 - cirrus: cs35l56: Add WHENCE links for 17aa233c spkid0 firmware - rtw89: 8922a: update REGD R73-R08, txpwr R46 and element of diag MAC - rtw89: 8852c: update REGD R73-R60, txpwr R82 and element of diag MAC - Update firmware for NPU PHX, STX and STX HALO - qcom: Update ADSP and add CDSP firmware for qcs6490-radxa-dragon-q6a - qcom: Remove ADSP SensorPD json for Radxa Dragon Q6A - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-154363 - Update linux-firmware to latest upstream (RHEL-145527) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145527 - Update linux-firmware to latest upstream (RHEL-119866) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 Resolves: RHEL-119866 - Fix random hangs of Dell Pro Max laptops when on battery power (RHEL-117675) - AMDGPU: Update firmware for Strix Halo (RHEL-104078) - AMDGPU: Add firmware for Gorgon Point (RHEL-107606) - Update linux-firmware to latest upstream Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-117675, RHEL-104078, RHEL-107606 - Update linux-firmware to latest upstream (RHEL-108921) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core Resolves: RHEL-108921 - nvidia-gpu-firmware was missing firmware/nvidia/ad10{3,4,6,7} directories (RHEL-95393) - Resume after suspend-to-ram did not restore screen on some AMD GPUs (RHEL-100947) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Add fan_control v203.0.0.0 for BMG - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95393, RHEL-100947 - 1.3.41.0 DDP firmware does not support QS silicon E825C nics (RHEL-92555) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops Resolves: RHEL-92555 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-154363) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - nxp: add firmware for IW61x WiFi device - mediatek MT7922: update bluetooth firmware to 20260605203811 - mediatek MT7925: update bluetooth firmware to 20260605184935 - linux-firmware: update firmware for MT7925 WiFi device - linux-firmware: update firmware for MT7922 WiFi device - amdgpu: DMCUB updates for various ASICs - qcom: add LPAICP firmware for shikra platform - qcom: Add qdsp6sw firmware for shikra platform - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7996 - linux-firmware: update firmware for MT7992 - linux-firmware: update firmware for MT7990 - qcom: Update ADSP firmware for Kaanapali platform - qcom: update ADSP firmware for glymur platform - qcom: update CDSP firmware for glymur platform - QCA: Add bluetooth firmware nvm files for USI/NFA725B - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Scorpius core - qcom: update ADSP firmware for qcs615 platform - cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Dell laptops - rtl_bt: Update RTL8852A BT USB firmware to 0x244F_91B6 - realtek: rt1321: Update the patch code to v1.10 - amdgpu: DMCUB updates for various ASICs - QCA: Update Bluetooth WCN3950 firmware 1.3.0-00108 to 1.3.0-00184 - qcom: update CDSP firmware for shikra platform - qcom: Update ADSP firmware for Glymur platform - Remove any files with unknown licenses - AGENTS.md, README: address second round of MR review - README: document AI assisted contribution convention - AGENTS.md: clarify areas raised in MR review - Add AGENTS.md for AI coding agents - LICENSES: update GPL-2.0 text and references - LICENSES: rename GPL-3 to GPL-3.0-only - LICENSES: rename Apache-2 to Apache-2.0 - Move firmware licenses to a LICENSES/ directory - qcom: update ADSP firmware for sm8750 platform - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00666 to 2.1.0-00669 - qcom: Update DSP firmware for qcs8300 platform - qcom: Update DSP firmware for sa8775p platform - amdgpu: Update DMCUB fw for DCN314 - amdgpu: revert yellow carp VCN firmware - amdgpu: revert vangogh VCN firmware - amdgpu: revert sienna cichlid VCN firmware - amdgpu: revert navy flounder VCN firmware - amdgpu: revert dimgrey cavefish VCN firmware - amdgpu: revert beige_goby VCN firmware - qcom: update CDSP firmware for x1e80100 platform - cirrus: cs35l56: Add firmware for Cirrus Amps for a Dell laptop - linux-firmware: Add RCA firmware files for tas257x projects - intel_vpu: Update NPU firmware - cirrus: cs35l63: Add Cirrus CS35L63 firmware mappings for various Dell laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for a couple of Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for a Lenovo laptop - QCA: Add BCS calibration binary for QCC2072 - QCA: Update Bluetooth firmware for QCC2072 UART interface - amdgpu: DMCUB updates for various ASICs - rtl_nic: add firmware rtl8261c.bin for RTL8261c - cirrus: cs35l56: Add Cirrus CS35L56 firmware mappings for two Dell laptops - i915: Xe3LPD DMC v2.36 - i915: Xe3LPD_3002 DMC v2.31 - i915: Xe3p_LPD DMC v2.37 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs42l45: Update CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - qcom: Add gpu firmwares for Shikra chipset - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - rtw89: 8852b: update fw to v0.29.29.18 - rtw89: 8852bt: update fw to v0.29.122.2 - amdgpu: Update gc 11.0.1 microcode - ASoC: tas2783: Add Firmware files for tas2783A projects - linux-firmware: add firmware for MT7927 WiFi device - Add HP ISH firmware for Intel Panther Lake systems - ti: Add PCM6240 firmware with multiple audio profiles support - qcom: add CDSP firmware for shikra platform - amdgpu: DMCUB updates for various ASICs - qcom: update ADSP firmware for x1e80100 platform - lt*_fw.bin: move to Lontium subdir - qcom: Add cdsp1r.jsn for sa8775p platform - amdgpu: rembrandt DMCUB v4.0.74.0 Resolves: RHEL-154363 - Update linux-firmware to latest upstream (RHEL-154363) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - linux-firmware: Add firmware for Lontium LT9611C - xe: Update GUC to v70.65.0 for LNL, BMG, PTL - amdgpu: update SMU 14.0.3 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update green sardine firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update SDMA 4.4.4 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update SDMA 4.4.5 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update VPE 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update SDMA 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update renoir firmware - amdgpu: update aldebaran firmware - rtl_bt: Add missing rtl8761a_config.bin for RTL8761AU - amdgpu: DMCUB updates for various ASICs - Linux-firmware: Add Dell ISH firmware 581.7783.0 for Intel Panther Lake systems. - qcom: update ADSP firmware for x1e80100 platform - linux-firmware:Add firmware for Lontium LT7911EXC bridge - qcom/x1e80100/dell: mark that qcom/NOTICE.txt is applicable too - qcom: Update CDSP firmware for Kaanapali platform - qcom: vpu: add Gen2 firmware binary for Agatti - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Update ADSP firmware for Glymur platform - mediatek MT7925: update bluetooth firmware to 20260414153243 - linux-firmware: update firmware for MT7925 WiFi device - Revert "linux-firmware: Update firmware file for Intel Quasar core" - qcom: Add gpdspr.jsn for qcs8300 platform - ath12k: QCC2072 hw1.0: add to WLAN.COL.1.0.c2-00074-QCACOLSWPL_V1_TO_SILICONZ-1 - ath12k: QCC2072 hw1.0: add board-2.bin - ath12k: IPQ5424 hw1.0: add to WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 - ath12k: IPQ5424 hw1.0: add board-2.bin - qcom: Update ADSP firmware for Kaanapali platform - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops (17aa235c 17aa235d) - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00665 to 2.1.0-00666 - amdgpu: DMCUB updates for DCN36 - linux-firmware: Update AMD cpu microcode - powervr: update Imagination Rogue firmware images - qcom: Update ADSP firmware for Kaanapali platform - i915: Xe3LPD DMC v2.34 - i915: Xe3LPD_3002 DMC v2.29 - qcom: Update ADSP firmware for QCM6490 platform - firmware/amdgpu: Update DMCUB fw to Release 0.1.55.0 - mediatek: vpu: drop old sym link - amdgpu: Revert Yellow Carp DMUB fw to 0x4000045 - linux-firmware: qcom: sync audioreach firmwares from v1.0.3 build - qcom: consolidate audioreach-tplg firmwares into one location in WHENCE - WHENCE: Fix ISH firmware symlink prefix for Lenovo PTL systems - intel_vpu: Update NPU firmware - Revert "rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673" - nvidia: add acr/bl symlink for booting GSP-RM on GA100 - qcom: add QUPv3 firmware for shikra - xe: Update GUC to v70.60.0 for LNL, BMG, PTL - qcom: update ADSP firmware for sm8750 platform - qcom: update CDSP firmware for glymur platform - cirrus: cs35l41: Add support for new HP laptops - cirrus: cs35l41: Add support for new ASUS laptops - cirrus: cs35l41: Add support for ASUS GZ302EAC and add 15.5dB bincfg - WHENCE: Move Dell remoteproc firmware to correct section - qcom: vpu: add video firmware for SM8450 - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - iwlwifi: add Bz/Sc FW for core103-40 release - iwlwifi: Add Hr/Gf firmware for core103-40 release - iwlwifi: update ty/So/Ma firmwares for core103-40 release - amdgpu: DMCUB updates for various ASICs - xe: Update PTL GSC to v105.0.2.1397 - linux-firmware: add firmware for Moxa mux50u devices - rtl_bt: Update RTL8852B BT USB FW to 0x127C_FD78 - ath11k: WCN6855 hw2.0@nfa765: update to WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - linux-firmware: update firmware for qat_4xxx devices - linux-firmware: update firmware for qat_402xx devices - linux-firmware: update firmware for qat_420xx devices - linux-firmware: update firmware for an8811hb 2.5G ethernet phy - linux-firmware: qcom: Add FW blobs for DELL XPS13 9345 - amdgpu: DMCUB updates for various ASICs - cirrus: cs35l63: Update firmware for Cirrus Amps for some Dell laptops - cirrus: cs35l63: Fix Cirrus Amp firmware links for some Dell laptops - linux-firmware: Add firmware file for Intel BlazarIW - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - iwlwifi: add Bz/Wh FW for core102-56 release - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 - mediatek MT7921: update bluetooth firmware to 20260224111243 - mediatek MT7920: update bluetooth firmware to 20260224111231 - Add LENOVO ISH firmware v5.8.1.7720 for X1 Carbon (Gen 14) and X1 2-in-1 (Gen 11) - linux-firmware: Add ISH firmware file for Intel Wildcat Lake platform - linux-firmware: update firmware for MT7920 WiFi device - linux-firmware: update firmware for MT7921 WiFi device - linux-firmware: Update firmware file for Intel Quasar core - Intel Bluetooth: Update firmware file for Intel Bluetooth AX201 - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS615 platform - Add LENOVO ISH firmware v5.8.0.7720 for X9-15 2025 - mediatek MT7922: update bluetooth firmware to 20260224103448 - linux-firmware: update firmware for MT7922 WiFi device - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l63: Add firmware for Cirrus CS35L63 for various Dell laptops - linux-firmware: Remove duplicate fw and Rename Lenovo ISH LNLM firmware files accordingly - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel BlazarIGfp2 core - QCA: Update Bluetooth QCA6698 firmware to 2.1.2-00069 - qcom: Update CDSP firmware for QCM6490 platform - linux-firmware: add firmware for Lontium LT8713SX DP hub - linux-firmware: qcom: sync audioreach firmwares from v1.0.2 build - qcom: update ADSP, CDSP firmware for sm8750 platform - qcom: update ADSP dtb.mbn for glymur platform - qca: Update Bluetooth WCN6750 1.1.3-00105 firmware to 1.1.3-00106 - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00659 to 2.1.0-00665 - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update beige goby firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update vangogh firmware - amdgpu: update navy flounder firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update SDMA 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update navi12 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update renoir firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update yellow carp firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i - amdnpu: Restore old NPU firmware for compatibility - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - lenovo: remove obsolete ish_lnlm_53c4ffad_2a17559f.bin firmware - linux-firmware: update firmware for MT7902 BT device - linux-firmware: update firmware for MT7902 WiFi device - qcom: vpu: fix SC7280 VPU Gen2 firmware and add compatibility symlink - amdgpu: DMCUB updates for various ASICs - qcom: Update DSP firmware for qcs8300 platform - cirrus: cs35l41: Add Firmware for ASUS Zenbook Laptop using CS35L41 HDA - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - rtw89: 8851b: add format-1 for fw v0.29.41.5 with fw elements - rtw89: 8852a: add format-1 for fw v0.13.36.2 with fw elements - rtw89: 8852bt: add regd and diag_mac and update txpwr to R09 - rtw89: 8852b: update txpwr element to R43 - rtw89: 8852b: add format-2 with v0.29.29.15 and fw elements - Revert "rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2" - xe: Update GUC to v70.58.0 for LNL, BMG, PTL - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6390 hw2.0: update board-2.bin - qcom: Add gpu firmwares for Glymur chipset - amdgpu: DMCUB updates for various ASICs - qcom: vpu: add video firmware for Glymur - qcom: add QUPv3 firmware for x1e80100 platform - Bluetooth: Add symbolic links for Intel Solar JfP2/1 firmware variants - Bluetooth: Add symbolic links for Intel Solar firmware variants - Bluetooth: Add symbolic links for Intel Pulsar firmware variants - Bluetooth: Add symbolic links for Intel AX201 firmware variants - ath10k: WCN3990 hw1.0: update board-2.bin - qcom: add ADSP, CDSP firmware for glymur platform - ASoC: tas2783: Add Firmware files for tas2783A - linux-firmware: Update firmware file for Intel Solar core - mediatek MT7921: update bluetooth firmware to 20251223091725 - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673 - ath12k: WCN7850 hw2.0: update board-2.bin - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update board-2.bin - WHENCE: Correct 2 trailing whitespaces - linux-firmware: Add firmware for airoha-npu-7581 driver used for MT7990 offloading - linux-firmware: Add Dell ISH firmware for Intel panther lake systems - amdgpu: DMCUB updates for various ASICs - linux-firmware: update Aeonsemi AS21x1x firmware to 1.9.1 - rtl_nic: add firmware rtl8125cp-1 for RTL8125cp - ice: update DDP LAG package to 1.3.2.0 - cirrus: cs35l56: Add WHENCE links for 17aa233c spkid0 firmware - rtw89: 8922a: update REGD R73-R08, txpwr R46 and element of diag MAC - rtw89: 8852c: update REGD R73-R60, txpwr R82 and element of diag MAC - Update firmware for NPU PHX, STX and STX HALO - qcom: Update ADSP and add CDSP firmware for qcs6490-radxa-dragon-q6a - qcom: Remove ADSP SensorPD json for Radxa Dragon Q6A - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-154363 - Update linux-firmware to latest upstream (RHEL-145527) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145527 - Update linux-firmware to latest upstream (RHEL-119866) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 Resolves: RHEL-119866 - Fix random hangs of Dell Pro Max laptops when on battery power (RHEL-117675) - AMDGPU: Update firmware for Strix Halo (RHEL-104078) - AMDGPU: Add firmware for Gorgon Point (RHEL-107606) - Update linux-firmware to latest upstream Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-117675, RHEL-104078, RHEL-107606 - Update linux-firmware to latest upstream (RHEL-108921) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core Resolves: RHEL-108921 - nvidia-gpu-firmware was missing firmware/nvidia/ad10{3,4,6,7} directories (RHEL-95393) - Resume after suspend-to-ram did not restore screen on some AMD GPUs (RHEL-100947) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Add fan_control v203.0.0.0 for BMG - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95393, RHEL-100947 - do not remove config when stopping lldpad (RHEL-84979) - RPMAUTOSPEC: unresolvable merge - Bump release for October 2024 mass rebuild: - Add gating.yaml and .fmf plan for RHEL gating - Bump release for June 2024 mass rebuild - Update to version 0.9.32 (rhbz#2261350) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Expand description for lmdb-libs subpackage - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 0.9.31 (rhbz#2221768) - migrated to SPDX license - Version bump - Update of location of fmf plans - Bump release for October 2024 mass rebuild: - Allow inet_addr() for now - Add fmf plans and gating.yaml - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New version 2.1.1 (rhbz#2250290) - Fix incorrect upstream URL and SourceX (rhbz#2249526) - SPDX migration - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 36.2.1 (fixes: rhbz#2215714) - Update to 36.1 (fixes: rhbz#2165689) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - disable "corrupted binary dump" test that has issues on big-endian architectures - apply upstream fix for 5.4.6 bug 1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 5.4.6 - add upstream fixes for Bugs 8 and 9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add patch for http://lua-users.org/lists/lua-l/2022-02/msg00112.html (#2111138) - Additional fixes up to 2.03.38. - Update to upstream version 2.03.36. - See WHATS_NEW and WHATS_NEW_DM for more information. - Update to upstream version 2.03.35. - See WHATS_NEW and WHATS_NEW_DM for more information. - Respin. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Add libnvme dependency to really fix the NVMe issue. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.8.5 - new-newa-traditional-extended: New input method by Swornim Nakarmi <svarnim.nakahmi1.618@gmail.com> - ml-pn-c: New input method for Malayalam by Ajith R <ajithramayyan at yahoo dot co dot in> - en-pn-eqf: This is a slightly modified version of the QWERTY English layout to be used along with the ml-pn-c input method - Update to 1.8.4 - New input methods from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" sa-vedic-itrans, dra-iso-15919-itrans, hi-brahmi-itrans, ks-sharada-itrans, mr-modi-itrans, sa-brahmi-itrans, sa-grantha-itrans, sa-iso-15919-itrans, sa-sharada-itrans, sa-inscript, sa-iast-vedic - hi-itrans: Updates from "विश्वासो वासुकिजः (Vishvas Vasuki)" <vishvas.vasuki@gmail.com> - ne-trad-ttf: Update from author, Santosh Pradhan <sapradhan8@gmail.com> - ja-trycode: Add icon. - ks-inscript: Add icon. - mai-inscript: Add icon. - ml-enhanced-inscript: Add icon. - mr-itrans: Add icon. - hi-remington: Add icon. - mr-typewriter: Add icon. - mr-phonetic: Add icon. - ne-rom-translit: Add icon. - zh-pinyin-yi: Add icon. - unicode: Add icon. - da-post: Add icon. - bo-ewts: Add icon. - bo-tcrc: Add icon. - kn-typewriter: Add icon. - grc-mizuochi: Add icon. - fr-azerty: Add icon. - hi-optitransv2: Updates from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" - kn-optitransv2: Updates from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" - sa-itrans: Updates from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" - kn-itrans: Updates from "विश्वासो वासुकिजः (Vishvas Vasuki)" <vishvas.vasuki@gmail.com> and some extra bug fixes. - lsymbol: Some additions from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" and some more improvements: Use emoji presentation when possible, better grouping in groups of 6, better description - math-latex: Updates from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" New option "with-backslash-prefix". - ks-kbd: Fix typo in description, add icon. - ug-kbd: Add icon. - tai-sonla-kbd.png: Add icon. - mni-inscript2-mtei.png: Add icon. - sat-inscript2-olck.png: Add icon. - or-phonetic.png: Add icon. - sa-harvard-kyoto.png: Add icon. - pa-anmollipi.png: Add icon. - pa-remington.png: Add icon. - si-singlish.png: Add icon. - ta-lk-renganathan.png: Add icon. - te-rts.png: Add icon. - vi-han.png: Add icon. - vi-nomvni: Make existing icon work. - vi-nomtelex: Make existing icon work. - lsymbol: Add icon. - ssymbol: Add icon. - Update to 1.8.3 - kok-inscript2-deva, mr-inscript, mr-inscript2: Fix digit 0 - ta-vutam: Change the header comment to a description - mr-gamabhana: icon resized to 48x48 - latn1-pre: add icon - ar-translit: add icon - ath-phonetic: add icon - bla-phonetic: add icon - cr-western: add icon - iu-phonetic: add icon - nsk-phonetic: add icon - oj-phonetic: add icon - uk-kbd: add icon - eo-vi-sistemo: add icon - Rename the .mim files of some eo input methods to improve search for the icons - Workarounds for doxygen - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.8.2 - Remove bn-national-jatiya input method (included upstream) - Remove si-sayura input method (included upstream) - Remove mr-gamabhana input method (included upstream) - Update German translations (100%) - Remove m17n-db-1.8.0-inscript2-mni-sat.patch (included upstream) - Remove m17n-db-1.6.5-number_pad_itrans-222634.patch This patch is not needed, numbers are typed in language representation when using the number pad with numlock on even without this patch. (I.e. the problem reported in https://bugzilla.redhat.com/show_bug.cgi?id=222634 is still fixed) - Add icon for hu-rovas-post input method - Remove m17n-db-1.6.5-kn-itrans_key-summary_bug228806.patch (See: https://git.savannah.nongnu.org/cgit/m17n/m17n-db.git/commit/?id=f10cfe21d49afbef40bdc681ff70563b6154eac0 after these upstream changes to kn-itrans, the summary added by the patch is wrong) - Remove m17n-db-1.6.5-bn-itrans-bug182227.patch (This patch removed mappings which are "not in ITRANS Bengali table", nevertheless these mappings might be useful to some users, better keep them for the time being) - Remove m17n-db-1.6.5-kn-inscript-ZWNJ-bug440007.patch (included upstream) - Remove m17n-db-1.7.0-fix-e-o-mappings.patch (included upstream) - Remvove fix for ld mapping in MIM/bo-ewts.mim (include upstream) (See: https://bugzilla.redhat.com/show_bug.cgi?id=1487512) - MIM/bo-ewts.mim: remove whitespace in rn and brn mapping - Update to 1.8.1 - Remove inscript2-20210820.tar.gz because it is now included upstream - Remove m17n-db-1.8.0-ml-mozhi-savannah-bug-59681.patch because it is included upstream - Remove unicode.mim because the improvement is included upstream - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.8.5 - new-newa-traditional-extended: New input method by Swornim Nakarmi <svarnim.nakahmi1.618@gmail.com> - ml-pn-c: New input method for Malayalam by Ajith R <ajithramayyan at yahoo dot co dot in> - en-pn-eqf: This is a slightly modified version of the QWERTY English layout to be used along with the ml-pn-c input method - Update to 1.8.4 - New input methods from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" sa-vedic-itrans, dra-iso-15919-itrans, hi-brahmi-itrans, ks-sharada-itrans, mr-modi-itrans, sa-brahmi-itrans, sa-grantha-itrans, sa-iso-15919-itrans, sa-sharada-itrans, sa-inscript, sa-iast-vedic - hi-itrans: Updates from "विश्वासो वासुकिजः (Vishvas Vasuki)" <vishvas.vasuki@gmail.com> - ne-trad-ttf: Update from author, Santosh Pradhan <sapradhan8@gmail.com> - ja-trycode: Add icon. - ks-inscript: Add icon. - mai-inscript: Add icon. - ml-enhanced-inscript: Add icon. - mr-itrans: Add icon. - hi-remington: Add icon. - mr-typewriter: Add icon. - mr-phonetic: Add icon. - ne-rom-translit: Add icon. - zh-pinyin-yi: Add icon. - unicode: Add icon. - da-post: Add icon. - bo-ewts: Add icon. - bo-tcrc: Add icon. - kn-typewriter: Add icon. - grc-mizuochi: Add icon. - fr-azerty: Add icon. - hi-optitransv2: Updates from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" - kn-optitransv2: Updates from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" - sa-itrans: Updates from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" - kn-itrans: Updates from "विश्वासो वासुकिजः (Vishvas Vasuki)" <vishvas.vasuki@gmail.com> and some extra bug fixes. - lsymbol: Some additions from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" and some more improvements: Use emoji presentation when possible, better grouping in groups of 6, better description - math-latex: Updates from https://github.com/indic-transliteration/m17n-db-indic "विश्वासो वासुकिजः (Vishvas Vasuki)" New option "with-backslash-prefix". - ks-kbd: Fix typo in description, add icon. - ug-kbd: Add icon. - tai-sonla-kbd.png: Add icon. - mni-inscript2-mtei.png: Add icon. - sat-inscript2-olck.png: Add icon. - or-phonetic.png: Add icon. - sa-harvard-kyoto.png: Add icon. - pa-anmollipi.png: Add icon. - pa-remington.png: Add icon. - si-singlish.png: Add icon. - ta-lk-renganathan.png: Add icon. - te-rts.png: Add icon. - vi-han.png: Add icon. - vi-nomvni: Make existing icon work. - vi-nomtelex: Make existing icon work. - lsymbol: Add icon. - ssymbol: Add icon. - Update to 1.8.3 - kok-inscript2-deva, mr-inscript, mr-inscript2: Fix digit 0 - ta-vutam: Change the header comment to a description - mr-gamabhana: icon resized to 48x48 - latn1-pre: add icon - ar-translit: add icon - ath-phonetic: add icon - bla-phonetic: add icon - cr-western: add icon - iu-phonetic: add icon - nsk-phonetic: add icon - oj-phonetic: add icon - uk-kbd: add icon - eo-vi-sistemo: add icon - Rename the .mim files of some eo input methods to improve search for the icons - Workarounds for doxygen - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.8.2 - Remove bn-national-jatiya input method (included upstream) - Remove si-sayura input method (included upstream) - Remove mr-gamabhana input method (included upstream) - Update German translations (100%) - Remove m17n-db-1.8.0-inscript2-mni-sat.patch (included upstream) - Remove m17n-db-1.6.5-number_pad_itrans-222634.patch This patch is not needed, numbers are typed in language representation when using the number pad with numlock on even without this patch. (I.e. the problem reported in https://bugzilla.redhat.com/show_bug.cgi?id=222634 is still fixed) - Add icon for hu-rovas-post input method - Remove m17n-db-1.6.5-kn-itrans_key-summary_bug228806.patch (See: https://git.savannah.nongnu.org/cgit/m17n/m17n-db.git/commit/?id=f10cfe21d49afbef40bdc681ff70563b6154eac0 after these upstream changes to kn-itrans, the summary added by the patch is wrong) - Remove m17n-db-1.6.5-bn-itrans-bug182227.patch (This patch removed mappings which are "not in ITRANS Bengali table", nevertheless these mappings might be useful to some users, better keep them for the time being) - Remove m17n-db-1.6.5-kn-inscript-ZWNJ-bug440007.patch (included upstream) - Remove m17n-db-1.7.0-fix-e-o-mappings.patch (included upstream) - Remvove fix for ld mapping in MIM/bo-ewts.mim (include upstream) (See: https://bugzilla.redhat.com/show_bug.cgi?id=1487512) - MIM/bo-ewts.mim: remove whitespace in rn and brn mapping - Update to 1.8.1 - Remove inscript2-20210820.tar.gz because it is now included upstream - Remove m17n-db-1.8.0-ml-mozhi-savannah-bug-59681.patch because it is included upstream - Remove unicode.mim because the improvement is included upstream - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.8.4 - Fixes “typedef in m17n-core.h causing error when compiling with C++ code” (Resolves: https://savannah.nongnu.org/bugs/index.php?64566) - Rebuild(libotf) - Update to 1.8.3 - Fixes to be able to create m17n-docs-1.8.3: Fix doxygen tags, change all EUC-JP files to UTF-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.8.2 - Fix parallel builds by switching from absolute to relative paths (Resolves: https://savannah.nongnu.org/bugs/index.php?61377) - enable parallel builds in the spec file - Update to 1.8.1 - Remove m17n-lib-c99.patch (included upstream) - Remove Fix-segmentation-fault-when-using-ibus-m17n-with-vi-telex-in-gedit-in-wayland.patch (included upstream) - Fix C99 compatibility issue in example code - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.8.4 - Fixes “typedef in m17n-core.h causing error when compiling with C++ code” (Resolves: https://savannah.nongnu.org/bugs/index.php?64566) - Rebuild(libotf) - Update to 1.8.3 - Fixes to be able to create m17n-docs-1.8.3: Fix doxygen tags, change all EUC-JP files to UTF-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.8.2 - Fix parallel builds by switching from absolute to relative paths (Resolves: https://savannah.nongnu.org/bugs/index.php?61377) - enable parallel builds in the spec file - Update to 1.8.1 - Remove m17n-lib-c99.patch (included upstream) - Remove Fix-segmentation-fault-when-using-ibus-m17n-with-vi-telex-in-gedit-in-wayland.patch (included upstream) - Fix C99 compatibility issue in example code - Ensure that we can upgrade from make-latest to make (RHEL-33540) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use guile-3.0 - Migrate License field to SPDX identifiers for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to make 4.4 - Handle SIGPIPE as a fatal signal - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Synchronize with Fedora version - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to version 3.3.2 - Rebase to version 3.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to version 3.1.4 - Bump release for June 2024 mass rebuild - Update Rust macro usage - Update to version 1.4.0 - Update to version 1.3.2 - Fix RHEL/ELN build - Update to version 1.2.3; Fixes RHBZ#2229485 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to version 1.1.0; Fixes RHBZ#2214007 - Rebuilt for Python 3.12 - Rebuild - Drop openjdk8 and openjdk11 subpackages - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Make JDK bindings work with different Maven version suffixes - Update to upstream version 3.9.6 - Add maven-openjdk21 - Convert License tag to SPDX format - Update to upstream version 3.9.4 - Add missing configuration file for maven-openjdk25 - Add maven-openjdk25 binding - Update to upstream version 3.9.9 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop OpenJDK 17 subpackage - Resolves: RHEL-51273 - Bump release for Aug 2024 java mass rebuild - Rebuild - Drop openjdk8 and openjdk11 subpackages - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add missing configuration file for maven-openjdk25 - Add maven-openjdk25 binding - Update to upstream version 3.9.9 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop OpenJDK 17 subpackage - Resolves: RHEL-51273 - Bump release for Aug 2024 java mass rebuild - Rebuild - Drop openjdk8 and openjdk11 subpackages - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump to 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 3.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to upstream version 3.4.1 - Update to upstream version 3.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump to 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 3.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to upstream version 3.4.1 - Update to upstream version 3.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add missing configuration file for maven-openjdk25 - Add maven-openjdk25 binding - Update to upstream version 3.9.9 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop OpenJDK 17 subpackage - Resolves: RHEL-51273 - Bump release for Aug 2024 java mass rebuild - Rebuild - Drop openjdk8 and openjdk11 subpackages - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.1 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to latest upstream 1.1 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Drop i686 JDKs - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - update to 4.8.31 - drop upstreamed python3 patch - rename fish -> shell - drop obsolete smb option - Disable gpm on ELN - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 4.8.30 - remove upstreamed mc-configure-c99.patch - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 4.8.29 - Port configure script to C99 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Stop verifying active selinux module - Remove obsolete tests - Bump release for June 2024 mass rebuild - Fix License tags to conform with SPDX - Resolves: RHEL-35721 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.6.23 - Resolves: rhbz#2257644 - Update license tag to fully conform to SPDX - Update to 1.6.22 - Resolves: rhbz#2244603 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix timing side-channel in SASL password database authentication (CVE-2026-47783) - Resolves: RHEL-179083 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Stop verifying active selinux module - Remove obsolete tests - Bump release for June 2024 mass rebuild - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Rebuild for mesa-25.0.7-6.el10_1 - Rebuild for mesa-25.0.7-5.el10_1 - fix llvmpipe constant loads on s390x - Rebuild for mesa-25.0.7-3.el10 - backport !32886 - Update to 25.0.7 - AMD Navi4x support - Update to 24.2.8 - Don't build python3-pyyaml - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Rebuild for mesa-25.0.7-6.el10_1 - Rebuild for mesa-25.0.7-5.el10_1 - fix llvmpipe constant loads on s390x - Rebuild for mesa-25.0.7-3.el10 - backport !32886 - Update to 25.0.7 - AMD Navi4x support - Update to 24.2.8 - Don't build python3-pyyaml - AlmaLinux changes: Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Fix s390x regressions - Enable va-driver only in Fedora - Rebuild mesa with LLVM 21 - Update to 25.2.7 - Bump release after rpmautospec re-init - Disable LTO globally - Update to 25.2.5 - fix llvmpipe constant loads on s390x - Enable NVK driver - Fix versioning - Update Intel CPU microcode to microcode-20260512 release (RHEL-176251) - New microcode files (in hex): 06-cc-02: Panther Lake: revision 011b 06-cc-03: Panther Lake: revision 011b - Microcode files (/platform_mask shown) with revision updates (in hex): 06-8f-07/87: Sapphire Rapids: 2b000661 to 2b000670 06-8f-08/87: Sapphire Rapids: 2b000661 to 2b000670 06-ad-01/20: Granite Rapids-X: a000133 to a000142 06-ad-01/95: Granite Rapids-X: 1000405 to 1000423 06-ae-01/97: Granite Rapids-D: 10002f3 to 1000307 06-af-03/01: Crestmont (Sierra Forest): 3000382 to 30003a3 06-bd-01/80: Lunar Lake: 0125 to 0126 06-c5-02/82: Arrow Lake-H: 011b to 0121 06-c6-02/82: Arrow Lake: 011b to 0121 06-cf-02/87: Emerald Rapids: 210002d3 to 210002e0 Resolves: RHEL-176251 - Update Intel CPU microcode to microcode-20260210 release (RHEL-150997) - Microcode files (/platform_mask shown) with revision updates (in hex): 06-6a-06/87: Ice Lake-X: d000410 to d000421 06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1 06-7e-05/80: Ice Lake-L: 00ca to 00cc 06-8c-01/80: Tiger Lake: 00bc to 00be 06-8c-02/c2: Tiger Lake: 003c to 003e 06-8d-01/c2: Tiger Lake-H: 0056 to 0058 06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661 06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421 06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661 06-97-02/07: Alder Lake: 003d to 003e 06-97-05/07: Alder Lake: 003d to 003e 06-9a-03/80: Alder Lake-L: 043a to 043b 06-9a-04/80: Alder Lake-L: 043a to 043b 06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c 06-9a-04/80: Alder Lake-L: 043a to 043b 06-a7-01/02: Rocket Lake: 0064 to 0065 06-aa-04/e6: Meteor Lake-L: 0025 to 0028 06-ad-01/20: Granite Rapids-X: a000124 to a000133 06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405 06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3 06-b5-00/80: Arrow Lake-U: 000a to 000d 06-b7-01/32: Raptor Lake: 0132 to 0133 06-ba-02/e0: Raptor Lake-P: 6133 to 6134 06-ba-03/e0: Raptor Lake-P: 6133 to 6134 06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021 06-bf-02/07: Raptor Lake-S: 003d to 003e 06-bf-05/07: Raptor Lake-S: 003d to 003e 06-c5-02/82: Arrow Lake-H: 011a to 011b 06-c6-02/82: Arrow Lake: 011a to 011b 06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3 Resolves: RHEL-150997 - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config (RHEL-123517) - Update Intel CPU microcode to microcode-20251111 release (RHEL-128195) - Addition of 06-ae-01/0x97 microcode at revision 0x1000273; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000401 up to 0x2c000410; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c000401 up to 0x2c000410; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000401 up to 0x2c000410; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c000401 up to 0x2c000410; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000643 up to 0x2b000650; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x3a up to 0x3d; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x3a up to 0x3d; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x3a up to 0x3d; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x3a up to 0x3d; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from revision 0x3a up to 0x3d; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from revision 0x3a up to 0x3d; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x3a up to 0x3d; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x3a up to 0x3d; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x3a up to 0x3d; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x3a up to 0x3d; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from revision 0x3a up to 0x3d; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from revision 0x3a up to 0x3d; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x437 up to 0x43a; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x437 up to 0x43a; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x437 up to 0x43a; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0xa up to 0xb; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x437 up to 0x43a; - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision 0xa000100 up to 0xa000124; - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision 0x10003d0 up to 0x10003f0; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000362 up to 0x3000382; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12f up to 0x132; - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from revision 0x12f up to 0x132; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4129 up to 0x6133; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4129 up to 0x6133; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4129 up to 0x6133; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4129 up to 0x6133; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4129 up to 0x6133; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4129 up to 0x6133; - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x123 up to 0x125; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1d up to 0x1e; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x3a up to 0x3d; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x3a up to 0x3d; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x3a up to 0x3d; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x3a up to 0x3d; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x3a up to 0x3d; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x3a up to 0x3d; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x3a up to 0x3d; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x3a up to 0x3d; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x3a up to 0x3d; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x3a up to 0x3d; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x3a up to 0x3d; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x3a up to 0x3d; - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x119 up to 0x11a; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) from revision 0x119 up to 0x11a; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x119 up to 0x11a; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x119 up to 0x11a; - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) from revision 0x119 up to 0x11a; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision 0x119 up to 0x11a; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x119 up to 0x11a; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x119 up to 0x11a; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x210002b3 up to 0x210002c0; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002b3 up to 0x210002c0. - Update Intel CPU microcode to microcode-20250812 release - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404 up to 0xd000410; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0 up to 0x10002e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24 up to 0x25; - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision 0xa0000d1 up to 0xa000100; - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision 0x10003a2 up to 0x10003d0; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341 up to 0x3000362; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up to 0x123; - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9 up to 0x210002b3. - Add a caveat to provide ability to persistently disable SPR-EE updates beyond 0x2b0005c0 on systems where absence of latency spikes is more important than lack of the latest CVE mitigations. (RHEL-94853) - Update Intel CPU microcode to microcode-20250512 release, addresses CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420, CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012 (RHEL-91227, RHEL-91242, RHEL-91234): - Addition of 06-8f-04/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-06/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision 0xa0000d1; - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision 0x10003a2; - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa; - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003707 up to 0x5003901; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904 up to 0x7002b01; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5 up to 0xd000404; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0 up to 0x10002d0; - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up to 0x26; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6 up to 0xca; - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode from revision 0xb8 up to 0xbc; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up to 0x3c; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up to 0x56; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode from revision 0xfc up to 0x100; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x436 up to 0x437; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x436 up to 0x437; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x436 up to 0x437; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up to 0xa; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436 up to 0x437; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision 0x102 up to 0x104; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc up to 0x100; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe up to 0x102; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfc up to 0x100; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up to 0x64; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20 up to 0x24; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330 up to 0x3000341; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up to 0x12f; - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from revision 0x12c up to 0x12f; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up to 0x1d; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291 up to 0x210002a9; - Update Intel CPU microcode to microcode-20250211 release, addresses CVE-2023-34440, CVE-2023-43758, CVE-2024-24582, CVE-2024-28047, CVE-2024-28127, CVE-2024-29214, CVE-2024-31068, CVE-2024-31157, CVE-2024-37020, CVE-2024-39279, CVE-2024-39355, CVE-2024-36293 (RHEL-79184, RHEL-79185, RHEL-79188, RHEL-79189, RHEL-79191, RHEL-79193, RHEL-79203): - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-af-03/0x01 (SRF-SP C0) microcode at revision 0x3000330; - Addition of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) at revision 0x12c; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Removal of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) at revision 0x2b000603; - Removal of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) at revision 0x2c000390; - Removal of 06-8f-05/0x87 (SPR-SP E2) microcode at revision 0x2b000603; - Removal of 06-8f-05/0x10 (SPR-HBM B1) microcode at revision 0x2c000390; - Removal of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) at revision 0x2b000603; - Removal of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) at revision 0x2c000390; - Removal of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) at revision 0x2b000603; - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) at revision 0x2b000603; - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) at revision 0x2c000390; - Removal of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) at revision 0x2b000603; - Removal of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) at revision 0x2c000390; - Removal of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) at revision 0x2b000603; - Removal of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) at revision 0x2c000390; - Removal of 06-8f-06/0x87 (SPR-SP E3) microcode at revision 0x2b000603; - Removal of 06-8f-06/0x10 microcode at revision 0x2c000390; - Removal of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) at revision 0x2b000603; - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) at revision 0x2b000603; - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) at revision 0x2c000390; - Removal of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) at revision 0x4123; - Removal of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) at revision 0x4123; - Removal of 06-ba-08/0xe0 microcode at revision 0x4123; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003e7 up to 0xd0003f5; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002b0 up to 0x10002c0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x435 up to 0x436; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x435 up to 0x436; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x435 up to 0x436; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x435 up to 0x436; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x7 up to 0x9; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision 0xf8 up to 0xfa; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision 0x100 up to 0x102; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x62 up to 0x63; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12b up to 0x12c; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1a up to 0x1c; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000283 up to 0x21000291. - Update Intel CPU microcode to microcode-20241112 release, addresses CVE-2024-21820, CVE-2024-21853, CVE-2024-23918, CVE-2024-23984 (RHEL-67335): - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x434 up to 0x435; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x434 up to 0x435; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1f up to 0x20; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x129 up to 0x12b; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode from revision 0x4122 up to 0x4123; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000230 up to 0x21000283. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update Intel CPU microcode to microcode-20240910 release, addresses CVE-2024-23984, CVE-2024-24853, CVE-2024-24968, CVE-2024-24980, CVE-2024-25939 (RHEL-58058): - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003605 up to 0x5003707; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002802 up to 0x7002904; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003d1 up to 0xd0003e7; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000290 up to 0x10002b0; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc4 up to 0xc6; - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode from revision 0xb6 up to 0xb8; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x36 up to 0x38; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x50 up to 0x52; - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf4 up to 0xf6; - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision 0xf4 up to 0xf6; - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from revision 0xf4 up to 0xf6; - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf4 up to 0xf6; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode from revision 0xfa up to 0xfc; - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x19 up to 0x1a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x433 up to 0x434; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x433 up to 0x434; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision 0xf6 up to 0xf8; - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf4 up to 0xf6; - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision 0xf6 up to 0xf8; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision 0xfc up to 0x100; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfa up to 0xfc; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfa up to 0xfe; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfa up to 0xfc; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5e up to 0x62; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1c up to 0x1f; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x123 up to 0x129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode from revision 0x4121 up to 0x4122; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x17 up to 0x1a (old pf 0x11). - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102716 - Synchronize with Fedora Rawhide Resolves: RHEL-73823 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release - RHEL-45470 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release - RHEL-45475 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.43.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.42.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add redistributable subpackage - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Apply -std=gnu89 to fix build with GCC 15 (C23 default) - Resolves: RHEL-129226 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release - RHEL-45473 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102716 - Synchronize with Fedora Rawhide Resolves: RHEL-73823 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release - RHEL-45470 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release - RHEL-45475 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.43.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.42.2 - Apply -std=gnu89 to fix build with GCC 15 (C23 default) - Resolves: RHEL-129226 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release - RHEL-45473 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - First build - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - add /usr/share/doc/mpfr ownership to the main package as well (RHEL-36695) - add /usr/share/doc/mpfr ownership (RHEL-36695) - fix use of uninitialized value in sin_cos (RHEL-44912) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - update to version 0.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - CI gating tests migration to tmt - Add explicit package version requirement for libtextstyle - Bump release for June 2024 mass rebuild - condition libtextstyle obsoletes - update to 0.22.5 release - https://savannah.gnu.org/news/?id=10597 - Add back libtextstyle library for rawhide (#2264128) - update to 0.22.4 release - https://savannah.gnu.org/news/?id=10544 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - RHEL-45477 - Fix gating error for RHEL10 - Bump release - RHEL-45477 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - new version v0.103 - Rename libmsi.so -> libmsi-1.0.so - Fix build on s390x - More SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New release v0.102 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fix flaky popup test - Fix flaky test case - Update to 49.4 - Update to 49.1.1 - Bundle newer meson - Use SPDX license - Deduce source URL from version - Fix path to gdctl when running installed test - Backport gdctl utility - Fix polyinstantiation preventing Xwayland to start - Handle unmaximize when headless - Fix flaky popup test - Fix flaky test case - Update to 49.4 - Update to 49.1.1 - Bundle newer meson - Use SPDX license - Deduce source URL from version - Fix path to gdctl when running installed test - Backport gdctl utility - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - cow: Support overlays larger than 16T on ext4 + further fixes resolves: RHEL-164229 - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - cow: Support overlays larger than 16T on ext4 + further fixes resolves: RHEL-164229 - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - cow: Support overlays larger than 16T on ext4 + further fixes resolves: RHEL-164229 - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - cow: Support overlays larger than 16T on ext4 + further fixes resolves: RHEL-164229 - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - fix buffer overflow in infocmp -i (CVE-2025-69720) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix creation of /var/lib/net-snmp in image mode (RHEL-132654) - fix out-of-bound access issue (RHEL-137498) - fix use after free issue (RHEL-121405) - Enable PQC in net-snmp (RHEL-93087) - Fix inverted use of -n in snmptrapd_log.c (RHEL-110514) - Resolves: RHEL-81121 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - update license tag and remove tests folder - Fix licensing issue in source code (RHEL-46905) - Add gating.yaml file - mountd: Minor refactor of get_rootfh() (RHEL-127093) - mountd: Separate lookup of the exported directory and the mount path (RHEL-127093) - support: Add a mini-library to extract and apply RPC credentials (RHEL-127093) - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127093) - Add requires for selinux-policy (RHEL-127093) Resolves: CVE-2025-12801 - nfsiostat: normalize the mountpoints passed in from the command line (RHEL-90562) - Remove /var/lib/nfs/v4recovery (RHEL-137935) - gssd: protect kerberos ticket cache access (RHEL-138461) - nfsrahead: modify get_device_info logic (RHEL-115964) - Fix dependency definition in rpc-statd.service (RHEL-96937) - Updated to nfs-utils-2-8-3 plus additional fixes from 2-8-4-rc1 (RHEL-88768) Resolves: RHEL-71286 Resolves: RHEL-82418 Resolves: RHEL-82557 Resolves: RHEL-85409 Resolves: RHEL-85413 Resolves: RHEL-88768 - fix ownership of /var/lib/nfs/statd/state (RHEL-77913) - /var/lib/nfs/{etab,rmtab} should not be marked as config files (RHEL-77912) - version handling fixes for nfsdctl and rpc.nfsd (RHEL-72477) - nfsdcltrack related manpage and configure file cleanup (RHEL-73500) - Updated to the latest release: nfs-utils-2-8-2 (RHEL-67786) Resolves: RHEL-65826 Resolves: RHEL-67041 Resolves: RHEL-67168 Resolves: RHEL-67786 Resolves: RHEL-68575 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix License tags to conform with SPDX - Resolves: RHEL-35720 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add additional SPDX licenses found by scancode tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to 2.1.54 - Change the License tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.36.0 release - migrate to SPDX license - Update to 1.34.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.32.0 release - applet: use appindicator if we can outside of X11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix gating string - add gating.yaml and test plan - Bump release for June 2024 mass rebuild - Fix loading unbundled undici builtin (rhbz#2259320) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 20.11.0 - remove bundled WASM blobs - sitelib is a symlink, not a dir - Fix missing %dir - Setup gating for c10s - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Do not attempt to build on s390x - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - own %{nodejs_sitelib} directory - initial import (rhbz#2245271) - Fix gating string - add gating.yaml and test plan - Bump release for June 2024 mass rebuild - Fix loading unbundled undici builtin (rhbz#2259320) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 20.11.0 - remove bundled WASM blobs - sitelib is a symlink, not a dir - Fix missing %dir - Fix gating string - add gating.yaml and test plan - Bump release for June 2024 mass rebuild - Fix loading unbundled undici builtin (rhbz#2259320) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 20.11.0 - remove bundled WASM blobs - sitelib is a symlink, not a dir - Fix missing %dir - Properly handle @group/package deps in nodejs-symlink-deps - Add test case for symlinked dependencies bug fix - added test/symlinked scenario - verifies nodejs.req correctly generates requirements for symlinked deps - added mock 'external' packages to support this test - Correctly determine if a package has bundled dependencies - Move ABI dependency generator to nodejs package - Use %autochangelog macro - Bump release for October 2024 mass rebuild: - Setup gating for c10s - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Setup gating for c10s - Bump release for June 2024 mass rebuild - Update to version 6.11.1 - Use wildcards in gitignore - Update to 5.28.3 (rhbz#2261973) - Load WASM from .wasm files - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Do not attempt to build on s390x - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to version 5.28.1 (rhbz#2251486) - fix incomplete ml-kem pct patch. - fix regression in -5 bug fix - fix a null in ml-dsa pkcs12 decode - fix return code in ml-kem pct - fips update - Fix indicators for the new post-quantum algorithms - Fix the ML-KEM Self-tests - Fix the ML-KEM zeroizaiton - Add partial public validation before OAEP - bug fixes - add CKA_SEED to private attributes so they are updated on password change. - mark CKA_PARAMETER_SET as CK_ULONG when storing into the database - fix unrefrence read in leancrypto. - fix interface issue when pulling 3.0 pkcs#11 interfaces explicitly - restore CONCATENATE functions accidentally removed in the last patch - fix big endian issue in tstclnt and selfserv in certificate compression - add fips required changes. - fix bugs found by QE - rebase to NSS 3.112 - add ml-kem-1024 support - add ml-dsa support - add nss-policy-check - fix the "Allow RSA-OAEP in FIPS mode" patch for the declaration after switch statement - fix changelog message for 3.101.0-11 - full fix to pss issues - fix pkcs12 defaults - fix pss issues - remove crmf - rebase fixes - restore mlkem aliases - add mlkem key lengths to the mechanism info - fix crash if you try to encapsulate with an unimported public key - restore distrusted certs to certdata.txt even though we never reference them to make tests happy. - rebase to upstream NSS 3.124 - backport ml-dsa support that is not upstream yet. - pick up in process patches upstream including eddsa - fix incomplete ml-kem pct patch. - fix regression in -5 bug fix - fix a null in ml-dsa pkcs12 decode - fix return code in ml-kem pct - fips update - Fix indicators for the new post-quantum algorithms - Fix the ML-KEM Self-tests - Fix the ML-KEM zeroizaiton - Add partial public validation before OAEP - bug fixes - add CKA_SEED to private attributes so they are updated on password change. - mark CKA_PARAMETER_SET as CK_ULONG when storing into the database - fix unrefrence read in leancrypto. - fix interface issue when pulling 3.0 pkcs#11 interfaces explicitly - restore CONCATENATE functions accidentally removed in the last patch - fix big endian issue in tstclnt and selfserv in certificate compression - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 12.1.14.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 12.0.16.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 11.1.5.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Depend on ocaml-rpm-macros instead of python3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.11 - simplify spec - Resolves: RHEL-85838 - Add gating infrastructure - Bump release for June 2024 mass rebuild - Update to 1.15.13 (RHBZ#2263327) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.15.8 (RHBZ#2255469) - Update to 1.15.1 (RHBZ #2246035) - Update to 1.14.0 (Fixes RHBZ#2236644) - Update to 1.13.5 (Fixes RHBZ#2230755) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add gating infrastructure - Bump release for June 2024 mass rebuild - Update to 1.15.13 (RHBZ#2263327) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.15.8 (RHBZ#2255469) - Update to 1.15.1 (RHBZ #2246035) - Update to 1.14.0 (Fixes RHBZ#2236644) - Update to 1.13.5 (Fixes RHBZ#2230755) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Set JDK version to 1.8 - Bump release for June 2024 mass rebuild - change subpackages licences to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - change of licences of ongres-scram and ongres-scram-javadoc to "BSD and MIT and ASL 2.0" - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Set JDK version to 1.8 - Bump release for June 2024 mass rebuild - change subpackages licences to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - change of licences of ongres-scram and ongres-scram-javadoc to "BSD and MIT and ASL 2.0" - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Set JDK version to 1.8 - Bump release for June 2024 mass rebuild - bump release for rebuild with gating.yaml - Move velocity-2 dependencies to codegenerator - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop codegenerator from install - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to 13.0.10 [RHEL-144577] - Resolves: RHEL-144577 ([ESXi][RHEL10] open-vm-tools version 13.0.10 has been released - please rebase) - Rebase to 13.0.5 [RHEL-118504] - Resolves: RHEL-118504 ([ESXi][RHEL10] open-vm-tools version 13.0.5 has been released - please rebase) - ovt-Handle-new-cloud-init-error-code-and-status.patch [RHEL-99781] - ovt-Address-CVE-2025-41244.patch [RHEL-117382] - Resolves: RHEL-99781 (Cloud-init receives TERM signal from PID 1 in the middle of running user data [rhel-10]) - Resolves: RHEL-117382 ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-10.2]) - Rebase to 13.0.0 [RHEL-99156] - Resolves: RHEL-99156 ([ESXi][RHEL10] open-vm-tools version 13.0.0 has been released - please rebase) - Rebase to 12.5.0 [RHEL-63092] - Resolves: RHEL-63092 ([ESXi][RHEL10] open-vm-tools version 12.5.0 has been released - please rebase) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to 12.4.1 [RHEL-45549] - Resolves: RHEL-45549 ([ESXi][RHEL10] open-vm-tools version 12.4.5 has been released - please rebase) - Bundle gtkmm3.0 stack on RHEL 10 to allow its removal - Update license string to SPDX format - Bump release for June 2024 mass rebuild - ovt-Drop-now-unneeded-gdk-pixbuf-xlib-dependency.patch [RHEL-40732] - Resolves: RHEL-40732 (Drop unneeded gdk-pixbuf-xlib dependency) - fix CVE-2025-54874: OOB heap memory write (RHEL-107568) - fix two heap buffer overflows CVE-2024-56826 and CVE-2024-52827 (RHEL-72518,RHEL-72520) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild - updated to 2.5.2 (#RHEL-48781) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - BR: liblerc-devel - Rebase to version 2.6.7 (rhbz#2261163) - Use systemd-sysusers for ldap user and group (rhbz#2173965) - Fix compiler errors (rhbz#2261427) - Replace License with SPDX identifier - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to version 2.6.6 Related: rhbz#2227948 - Rebase to version 2.6.5 Related: rhbz#2221798 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Apply upstream patch to fix C99 compatibility issues - Rebase to version 2.6.4 Related: rhbz#2168351 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to version 2.6.7 (rhbz#2261163) - Use systemd-sysusers for ldap user and group (rhbz#2173965) - Fix compiler errors (rhbz#2261427) - Replace License with SPDX identifier - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to version 2.6.6 Related: rhbz#2227948 - Rebase to version 2.6.5 Related: rhbz#2221798 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Apply upstream patch to fix C99 compatibility issues - Rebase to version 2.6.4 Related: rhbz#2168351 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - After bumping the epoch, we need to change the subpackage requires to use it - Bump the epoch to support upgrade path from previous versions of RHEL - Bump release for June 2024 mass rebuild - Add support for riscv64 - Update to 5.0.2 - Drop unused BR on infinipath-psm - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.0.1 - Disable building docs in RHEL builds - Update to 5.0.0 - Drops 32-bit i686 support - Drops C++ bindings - Add doc sub-package - After bumping the epoch, we need to change the subpackage requires to use it - Bump the epoch to support upgrade path from previous versions of RHEL - Bump release for June 2024 mass rebuild - Add support for riscv64 - Update to 5.0.2 - Drop unused BR on infinipath-psm - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.0.1 - Disable building docs in RHEL builds - Update to 5.0.0 - Drops 32-bit i686 support - Drops C++ bindings - Add doc sub-package - Add AlmaLinux definitions - Bump release for June 2024 mass rebuild - Update gating tests - Rebase to the latest upstream version - Use NSS as cryptography library (RHEL-22013) - add conditionals to be able to rebuild with opendbx/apt even on EPEL+RHEL - cosmetics: rename patches, add comments, use buildroot macro instead of env - add explicit build requirement to python3-setuptools, needed for 3.13+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable opendbx for SQL probes only in Fedora - Fix C compatibility issues - Fix test test_sysctl_probe_all.sh - Clean up the repository - adding conditional for apt-devel apt-libs as proposed upstream - Add AlmaLinux definitions - Bump release for June 2024 mass rebuild - Update gating tests - Rebase to the latest upstream version - Use NSS as cryptography library (RHEL-22013) - add conditionals to be able to rebuild with opendbx/apt even on EPEL+RHEL - cosmetics: rename patches, add comments, use buildroot macro instead of env - add explicit build requirement to python3-setuptools, needed for 3.13+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable opendbx for SQL probes only in Fedora - Fix C compatibility issues - Fix test test_sysctl_probe_all.sh - Clean up the repository - adding conditional for apt-devel apt-libs as proposed upstream - Add AlmaLinux definitions - Bump release for June 2024 mass rebuild - Update gating tests - Rebase to the latest upstream version - Use NSS as cryptography library (RHEL-22013) - add conditionals to be able to rebuild with opendbx/apt even on EPEL+RHEL - cosmetics: rename patches, add comments, use buildroot macro instead of env - add explicit build requirement to python3-setuptools, needed for 3.13+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable opendbx for SQL probes only in Fedora - Fix C compatibility issues - Fix test test_sysctl_probe_all.sh - Clean up the repository - adding conditional for apt-devel apt-libs as proposed upstream - Add AlmaLinux definitions - Bump release for June 2024 mass rebuild - Update gating tests - Rebase to the latest upstream version - Use NSS as cryptography library (RHEL-22013) - add conditionals to be able to rebuild with opendbx/apt even on EPEL+RHEL - cosmetics: rename patches, add comments, use buildroot macro instead of env - add explicit build requirement to python3-setuptools, needed for 3.13+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable opendbx for SQL probes only in Fedora - Fix C compatibility issues - Fix test test_sysctl_probe_all.sh - Clean up the repository - adding conditional for apt-devel apt-libs as proposed upstream - Add AlmaLinux definitions - Bump release for June 2024 mass rebuild - Update gating tests - Rebase to the latest upstream version - Use NSS as cryptography library (RHEL-22013) - add conditionals to be able to rebuild with opendbx/apt even on EPEL+RHEL - cosmetics: rename patches, add comments, use buildroot macro instead of env - add explicit build requirement to python3-setuptools, needed for 3.13+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable opendbx for SQL probes only in Fedora - Fix C compatibility issues - Fix test test_sysctl_probe_all.sh - Clean up the repository - adding conditional for apt-devel apt-libs as proposed upstream - Bump release for June 2024 mass rebuild - Change gating tests - Update to the latest upstream release - Avoid tox dependency - 0.2.7 (Jan Rodak) - Add tool tip to search bar (Jan Rodak) - Enable search by reference (Jan Rodak) - Add generation search infromation (Jan Rodak) - Use macro for generation of list items (Jan Rodak) - Create two-tier display of Evaluation Characteristics (Jan Rodak) - Add title (Jan Rodak) - Reduce complexity of function generate_referenced_endpoints (Jan Rodak) - Use default dict (Jan Rodak) - Fix JSON schema (Jan Rodak) - Use correct orthography of addresses types acronyms (Jan Rodak) - Add function to update known references (Jan Rodak) - Change the presentation of referenced endpoints (Jan Rodak) - Add new elements (Jan Rodak) - Add onclick function (Jan Rodak) - Add map of OVAL endpoints (Jan Rodak) - Add target addresses to report (Jan Rodak) - Add target addresses to model (Jan Rodak) - Fix width of pre element (Jan Rodak) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.2.6 (Jan Rodak) - Extend the condition to account empty strings in href (Jan Černý) - Add comments for the pylint tool (Jan Černý) - Add special classes to table element (Jan Černý) - Account for missing reference href attribute (Jan Černý) - Add pragmas to avoid PEP8 warnings (Jan Černý) - Present references in a table (Jan Černý) - Collapse CPE tree when is true (Jan Rodak) - Fix typo (Jan Rodak) - Add titles (Jan Rodak) - Fix performace of generation of graphs (Jan Rodak) - Rearrange fields of rule detail and OVAL definition detail (Jan Rodak) - Fix bugs in html (Jan Rodak) - 0.2.5 (Jan Rodak) - Show referenced OVAL State (Jan Rodak) - Parse reference in filter (Jan Rodak) - Show OVAL Variables and referenced OVAL endpoints in report (Jan Rodak) - Remove UUID from headings (Jan Rodak) - Move function (Jan Rodak) - Display in report OVAL object that references to other OVAL Objects (Jan Rodak) - Resolve parsing of referenced OVAL Objects and OVAL Variables (Jan Rodak) - Add OVAL Variable structure and parser (Jan Rodak) - Rework OVAL Object and State (Jan Rodak) - Parse mapping between OVAL var and values and propagate them (Jan Rodak) - Remove namesapace for attributes (Jan Rodak) - Show OVAL states in report (Jan Rodak) - Parse attributes of elements in OVAL state and Parse all OVAL states in OVAL test (Jan Rodak) - Show OVAL objects in report (Jan Rodak) - Parse attributes of elements in OVAL object (Jan Rodak) - Removing the processing of collected objects (Jan Rodak) - Use an empty string instead of None when the text of the set-value element is empty (Jan Rodak) - Fix deprecation warning (Jan Rodak) - Remove product detection from the tmt plan (Jan Rodak) - Increase vm memory (Jan Rodak) - Add python3 dependency (Jan Rodak) - Adjust the build of content (Jan Rodak) - Automatic product detection to build content by CPE identifier (Jan Rodak) - Remove whitespaces (Jan Rodak) - Show explanation of score computation in report (Jan Rodak) - Add explanation of score computation (Jan Rodak) - Parse system attribute from score element (Jan Rodak) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix gating failure Resolves: RHEL-70724 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Unpatch Red Hat help message - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166238 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166222 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166190 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166206 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155812 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151579 - Support of hybrid MLKEM key exchange methods in FIPS mode Resolves: RHEL-125929 - Adding a mechanism to disable GSSAPIDelegateCredentials in sshd_config Resolves: RHEL-5281 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-128399 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-128388 - Implement mlkem768nistp256-sha256 and mlkem1024nistp384-sha384 KEX methods Resolves: RHEL-70824 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-118406 - Canonicalize username when matching a user Resolves: RHEL-101440 - Unpatch Red Hat help message - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193170 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193016 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186435 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185826 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185852 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166238 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166222 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166190 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166206 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155812 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151579 - Support of hybrid MLKEM key exchange methods in FIPS mode Resolves: RHEL-125929 - Adding a mechanism to disable GSSAPIDelegateCredentials in sshd_config Resolves: RHEL-5281 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-128399 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-128388 - Unpatch Red Hat help message - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245413 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245423 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245418 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236314 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236288 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193170 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193016 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186435 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185826 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185852 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166238 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166222 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166190 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166206 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155812 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151579 - Support of hybrid MLKEM key exchange methods in FIPS mode Resolves: RHEL-125929 - Unpatch Red Hat help message - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258463 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245413 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245423 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245418 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236314 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236288 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193170 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193016 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186435 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185826 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185852 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166238 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166222 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166190 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166206 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155812 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151579 - Unpatch Red Hat help message - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-276225 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: RHEL-276232 - CVE-2026-60000: Fix DoS via excessive GSSAPI authentication attempts Resolves: RHEL-276227 - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258463 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245413 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245423 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245418 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236314 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236288 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193170 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193016 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186435 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185826 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185852 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166238 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166222 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166190 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166206 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155812 - Modify RPM verification of ssleay.cnf Related: RHEL-113443 - Fix bogus 'sscg' arguments Related: RHEL-113443 - Update to openwsman-2.8.1 Resolves: RHEL-99191 - Update OpenSSL certificates set up Resolves: RHEL-113443 - Support added for post-quantum cryptography Resolves: RHEL-93091 - Remove deprecated path from systemd service file Resolves: RHEL-101169 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update license tags in subpackages to SPDX format - Modify RPM verification of ssleay.cnf Related: RHEL-113443 - Fix bogus 'sscg' arguments Related: RHEL-113443 - Update to openwsman-2.8.1 Resolves: RHEL-99191 - Update OpenSSL certificates set up Resolves: RHEL-113443 - Support added for post-quantum cryptography Resolves: RHEL-93091 - Remove deprecated path from systemd service file Resolves: RHEL-101169 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update license tags in subpackages to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 0.4.39 - Add patch for div255w fix on ppc64le - Resolves: RHEL-50713 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Move orc-test to main package - Update to 0.4.38 - Version the library to catch bumps - Cleanup spec, use license var - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.4.33 - Add AlmaLinux repositories - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - Add AlmaLinux repositories - Add AlmaLinux and AlmaLinux Kitten x86_64_v2 support - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - Add AlmaLinux repositories - Add AlmaLinux and AlmaLinux Kitten x86_64_v2 support - Update to 165.1 - go.mod: update osbuild/images to v0.245.1, adding the PQC keys to the rhel-9 and rhel-10 rolling distribution repository configs - Test repository definitions are left at their upstream values - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - Add AlmaLinux repositories - Add AlmaLinux and AlmaLinux Kitten x86_64_v2 support - go.mod: update osbuild/images to 61b16700, enabling bootupd metadata generation for edge-commits including 9.6+ images - go.mod: bump indirect golang.org/x/net dependency to v0.56.0 (CVE-2026-25681, CVE-2026-27136, CVE-2026-42502) - go.mod: update github.com/labstack/echo/v4 to v4.15.3 (CVE-2026-55677) - go.mod: update go.opentelemetry.io/otel to v1.44.0 (CVE-2026-41178) - Patches taken from the upstream rhel-9.8_10.2 branch - Update to 165.1 - go.mod: update osbuild/images to v0.245.1, adding the PQC keys to the rhel-9 and rhel-10 rolling distribution repository configs - Test repository definitions are left at their upstream values - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - Bump release for package rebuild - New upstream release - New upstream release - New upstream release - pam_faillock: skip clearing user's failed attempt. Resolves: RHEL-130871 - pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-101174 - pam_access: rework resolving of tokens as hostname. Resolves: CVE-2024-10963 and RHEL-66241 - pam_access: always match local address and clarify LOCAL keyword behaviour. Resolves: RHEL-65223 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - spec: Use Requires(meta): authselect. Resolves: RHEL-56703 - Bump release for June 2024 mass rebuild - Fix static analyzer detected issues. Resolves: RHEL-36475 - pam_env: fixes for NULL environment variables - Rebase to release 1.6.1 - Disable nis support - pam_unix: do not warn if password aging is disabled (#2263689) - pam_userdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704 - pam_faillock: skip clearing user's failed attempt. Resolves: RHEL-130871 - pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-101174 - pam_access: rework resolving of tokens as hostname. Resolves: CVE-2024-10963 and RHEL-66241 - pam_access: always match local address and clarify LOCAL keyword behaviour. Resolves: RHEL-65223 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - spec: Use Requires(meta): authselect. Resolves: RHEL-56703 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 1.54.0 - Drop the pango-tests sub package - Update to 1.52.2 - Update to 1.51.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.51.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.50.14 - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Update to 2.46.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.46.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Update to 2.46.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.46.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Update to 2.46.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.46.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - remove gnulib dependency and use bundled one - RHEL-33500 - apply hardening ldflags for localepaper - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 2.1.0 - update to 2.0.10 - RHEL-67571 password is ignored when set in web ui - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - the last change changes ABI - lprint has to be rebuilt - RHEL-50774 enlarge array for vendor specific attributtes - RHEL-25805 [pappl] rebase pappl to 1.4.6 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2255704 - pappl-1.4.4 is available - rebase to version 1.4.3 (#2250222) - Resolves: RHEL-71659 Fix additional memory leak - not detected by OSH - Fix Openscanhub issues (Resolves: RHEL-71659) - Initial commit on c10s Resolves: RHEL-25298 - Bump release for June 2024 mass rebuild - Rebase to a new version to fix SAST failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - New upstream release - New upstream release - New upstream release - Recommend avahi for the daemon package - Obsolete versions from before the -libs split - Bump release for June 2024 mass rebuild - Rebase to a new version to fix SAST failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - New upstream release - New upstream release - New upstream release - Recommend avahi for the daemon package - Obsolete versions from before the -libs split - Bump release for June 2024 mass rebuild - Rebase to a new version to fix SAST failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - New upstream release - New upstream release - New upstream release - Recommend avahi for the daemon package - Obsolete versions from before the -libs split - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release because of gating.yaml change - Bump release because of ci.fmf change - Bump release because of gating.yaml change - Update license tag to conform with SPDX - Resolves: RHEL-35723 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - add pcilmr which allows margin PCIe Links (RHEL-95483) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix memory leak (#RHEL-44664) - Bump release for June 2024 mass rebuild - rebuild - updated to 3.13, adds support for cxl1.1 device link status information (#RHEL-29153) - add riscv64 build support (#RHEL-40383) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add /usr/bin/lspci symlink to fix detection by some games (#1858437) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest stable version of PCP (RHEL-43429) - Rebase to latest stable version of PCP (RHEL-30198) - Fix python sub-package year day range issue (RHEL-25543) - Rebase to latest stable version of PCP (RHEL-2317) - Fix pcp-ss(1) handling of UDP packet states (RHEL-17649) - Fix pcp-ss(1) default handling of listen state (RHEL-17335) - Added pcp package dependency on diffutils for diffstat(1) - Improve pmlogcheck performance with compressed archives (RHEL-3930) - Fix pcp-ss(1) utility handling of duplicate sources (RHEL-7498) - Fine-tune PCP python wrapper path resolution (RHEL-7509) - Rebase to latest stable version of PCP (RHEL-2317) - Bump release for June 2024 mass rebuild - Update to latest stable version of PCP (RHEL-43429) - Rebase to latest stable version of PCP (RHEL-30198) - Fix python sub-package year day range issue (RHEL-25543) - Rebase to latest stable version of PCP (RHEL-2317) - Fix pcp-ss(1) handling of UDP packet states (RHEL-17649) - Fix pcp-ss(1) default handling of listen state (RHEL-17335) - Added pcp package dependency on diffutils for diffstat(1) - Improve pmlogcheck performance with compressed archives (RHEL-3930) - Fix pcp-ss(1) utility handling of duplicate sources (RHEL-7498) - Fine-tune PCP python wrapper path resolution (RHEL-7509) - Rebase to latest stable version of PCP (RHEL-2317) - Bump release for June 2024 mass rebuild - Update to latest stable version of PCP (RHEL-43429) - Rebase to latest stable version of PCP (RHEL-30198) - Fix python sub-package year day range issue (RHEL-25543) - Rebase to latest stable version of PCP (RHEL-2317) - Fix pcp-ss(1) handling of UDP packet states (RHEL-17649) - Fix pcp-ss(1) default handling of listen state (RHEL-17335) - Added pcp package dependency on diffutils for diffstat(1) - Improve pmlogcheck performance with compressed archives (RHEL-3930) - Fix pcp-ss(1) utility handling of duplicate sources (RHEL-7498) - Fine-tune PCP python wrapper path resolution (RHEL-7509) - Rebase to latest stable version of PCP (RHEL-2317) - Bump release for June 2024 mass rebuild - Update to latest stable version of PCP (RHEL-43429) - Rebase to latest stable version of PCP (RHEL-30198) - Fix python sub-package year day range issue (RHEL-25543) - Rebase to latest stable version of PCP (RHEL-2317) - Fix pcp-ss(1) handling of UDP packet states (RHEL-17649) - Fix pcp-ss(1) default handling of listen state (RHEL-17335) - Added pcp package dependency on diffutils for diffstat(1) - Improve pmlogcheck performance with compressed archives (RHEL-3930) - Fix pcp-ss(1) utility handling of duplicate sources (RHEL-7498) - Fine-tune PCP python wrapper path resolution (RHEL-7509) - Rebase to latest stable version of PCP (RHEL-2317) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - New upstream release. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release (#2251427) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release (#2213961) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove downstream patch breaking flatpak (#2054826) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Patch the code to use https instead of http (CVE-2024-45321) - Resolves: RHEL-56507 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.7047 bump (rhbz#2227489) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Perl 5.38 rebuild - 3.02 bump - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181651 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Fix CVE-2026-9538: cap per-entry declared size during archive reading to prevent memory DoS - Resolves: RHEL-191918 - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181651 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update dependencies of sub-package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.1700 bump (rhbz#2231059) - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update Compress::Raw::Zlib for improved compatibility with zlib-ng - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod> or release notes - Make BerkeleyDB support optional - Fix locale when use embedding Perl in C (bug #2240458) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.007 - Advertise XSLoader dependency in metadata - Update to 0.006 - Disable prototypes to silence warning - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.007 - Advertise XSLoader dependency in metadata - Update to 0.006 - Disable prototypes to silence warning - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 4.61 bump (rhbz#2257292) - Remove unused dependency perl(Test::CPAN::Changes) - 4.60 bump (rhbz#2247441) - 4.59 bump (rhbz#2241705) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 4.57 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.018 - Fix version requirement for CPAN::Meta::Prereqs - Move issue tracker to GitHub - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.017 - Use Module::Metadata for more accurate testing - Update to 0.015 - Drop Test::Deep prereq - Use SPDX-format license tag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Perl 5.40 rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Perl 5.38 rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-79491 - Update man page - Resolves: RHEL-79491 - Fix permission for creating site directories - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use macro for buildroot - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 1.54 as provided in perl-5.37.11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Modernize spec. - Convert license to SPDX. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.15 (rhbz#2175585) - Localize $SIG{__DIE__} before calling eval (CPAN RT#146848) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.14 (rhbz#2161420) - Remove Test::Fatal and Test::Needs from test prereqs (GH#7, GH#8) - Use SPDX-format license tag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Modernize spec - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - 2.212 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.206 bump (rhbz#2225675) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.205 bump (rhbz#2223210) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Update to 2.212 - Package tests - Bump release for June 2024 mass rebuild - Rebuild against xz 5.4.6 (RHBZ#2260521) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild against xz 5.4.5 (RHBZ#2247487) - Rebuild against xz 5.4.4 (RHBZ#2228542) - Resolves: RHEL-132687 - Rebuild for latest zlib-ng - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - 2.212 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for zlib-ng in Rawhide - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - 0.36 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.34 bump (bug #2229845) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.41 - Adopt new repo structure - see: http://savage.net.au/Ron/html/My.Workflow.for.Building.Distros.html - Reformat Makefile.PL - Add t/00.* - Update POD to change RT to GitHub - Package new LICENSE file - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Spec tidy-up - Use author-independent source URL - Specify all build dependencies - Simplify Digest::MD5 versioned dependency generation using a patch - Simplify find command using -delete - Fix permissions verbosely - Make %files list more explicit - Resolves: RHEL-66250 - Remove notes about mariadb-connector-c and SSL - Resolves: RHEL-66250 - Updated notes related to the issue - Generate SSL needed for tests since mariadb-connector-c 3.4.x - Resolves: RHEL-66250 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Replace using mysql by mariadb in setup script - 1.23 bump (rhbz#2238227) - Fix FTBFS caused by planned change RHEL-68750 Resolves: RHEL-75748 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - 5.007 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 5.003 bump (rhbz#2252375) - 5.002 bump (rhbz#2245834) - Use community-mysql also for ELN - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 3.18.0 bump (rhbz#2253383) - Package tests - 3.17.0 bump (rhbz#2234337) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.74 bump (rhbz#2239708) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.72 bump - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix CVE-2014-10401 and CVE-2014-10402 - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Fix CVE-2026-9698: stack overflow and buffer overflow in DBI.xs - Resolves: RHEL-184980 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Fix CVE-2026-14380: unsafe string eval in DBI::Profile - Resolves: RHEL-211146 - Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders - Resolves: RHEL-193293 - Fix CVE-2026-9698: stack overflow and buffer overflow in DBI.xs - Resolves: RHEL-184980 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Bump release for Aug 2024 java mass rebuild - Fix CVE-2026-19546: incomplete fix for CVE-2026-14380 in DBI::Profile Resolves: RHEL-236830 - Fix CVE-2026-14380: unsafe string eval in DBI::Profile - Resolves: RHEL-211146 - Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders - Resolves: RHEL-193293 - Fix CVE-2026-9698: stack overflow and buffer overflow in DBI.xs - Resolves: RHEL-184980 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix CVE-2026-73194: enforce placeholder range limit on :N style placeholders Resolves: RHEL-247316 - Fix CVE-2026-19546: incomplete fix for CVE-2026-14380 in DBI::Profile Resolves: RHEL-236830 - Fix CVE-2026-14380: unsafe string eval in DBI::Profile - Resolves: RHEL-211146 - Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders - Resolves: RHEL-193293 - Fix CVE-2026-9698: stack overflow and buffer overflow in DBI.xs - Resolves: RHEL-184980 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting memory read during numeric type casting Resolves: RHEL-271970 - Fix CVE-2026-73194: enforce placeholder range limit on :N style placeholders Resolves: RHEL-247316 - Fix CVE-2026-19546: incomplete fix for CVE-2026-14380 in DBI::Profile Resolves: RHEL-236830 - Fix CVE-2026-14380: unsafe string eval in DBI::Profile - Resolves: RHEL-211146 - Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders - Resolves: RHEL-193293 - Fix CVE-2026-9698: stack overflow and buffer overflow in DBI.xs - Resolves: RHEL-184980 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Upgrade to 2.189 based on perl-5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Upgrade to 2.188 based on perl-5.37.11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Upgrade to 2.189 based on perl-5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.114 - Data::OptList now requires perl v5.12.0 - Tests no longer add "-T" to shebang, so do not invoke taint mode - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.113 (rhbz#2157247) - Update author contact info - Use SPDX-format license tag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.200008 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Update to 1.227 - New maintainer, GTERMARS - Add basic GitHub Actions setup for testing - Typo corrections in POD - Eliminated use of state/node files in temp directory - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.94 bump (rhbz#2257491) - Package tests - Adapt test envinronment guard to changes in 6.93 - List files explicitly - Run tests in parallel - Release: v6.93 (Sullivan Beck) - Checkpoint: v6.93 (Sullivan Beck) - Remove Travis (Sullivan Beck) - Initial checkin of next release cycle: 6.93 (Sullivan Beck) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2213282 - Rebase to upstream version 6.92. - 2174484 - Rebase to upstream version 6.91. - Fix CVE-2026-60075: prevent quadratic-cost regex DoS in date/time parsing by rejecting overly long input strings Resolves: RHEL-239790 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Move redhat-rpm-config from tests to main package - Requires: redhat-rpm-config for tests - Package tests - Add test BR gcc to not skip the tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX-format license tag - Use author-independent source URL - Drop redundant buildroot cleaning in %install section - Drop support for old Perl versions needing XS helper - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Upgrade to 3.72 based on perl-5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - 0.84 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Upstream update. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Modernize spec. - Convert license to SPDX. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.59 bump (rhbz#2256301) - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.59 bump (rhbz#2256301) - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - 6.04 bump (rhbz#2173329) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 6.03 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - 6.04 bump (rhbz#2173329) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Resolves: RHEL-43260 - Update to 3.21 - Update License tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 3.20 bump (rhbz#2248987) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Increase release to solve conflicts with sub-package perl-encoding in the module perl-bootstrap - 3.19 bump - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Resolves: RHEL-43260 - Update to 3.21 - Update License tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 3.20 bump (rhbz#2248987) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 1.06 as provided in perl-5.37.11 - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update Compress::Raw::Zlib for improved compatibility with zlib-ng - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod> or release notes - Make BerkeleyDB support optional - Fix locale when use embedding Perl in C (bug #2240458) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX-format license tag - Use %license unconditionally - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.006002 Documentation - Link to Exporter::Almighty in pod - Update copyright dates Packaging - Set homepage in metadata to https://exportertiny.github.io - Update to 1.006001 Documentation - Don't mention Alt::Lexical::Var::ButSupportModernPerl in manual Packaging - No longer dynamically recommend Alt::Lexical::Var::ButSupportModernPerl - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.006000 - Introduced lexical exporter support on Perl 5.11.2+ using the Lexical::Var module - Refactored the Perl 5.37.2+ lexical exporter support - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 5.78 bump (rhbz#2256294) - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Upgrade to 0.280240 as provided in 5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 0.280238 as provided in perl-5.37.11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 2.22 bump - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 1.75 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filter of dependencies - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Replace patch update from Perl release by CPAN upstream 3.51 (rhbz#2237243) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 3.51 as provided in perl-5.37.12 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Specify all dependencies - Package examples - Package the tests - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update Compress::Raw::Zlib for improved compatibility with zlib-ng - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod> or release notes - Make BerkeleyDB support optional - Fix locale when use embedding Perl in C (bug #2240458) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Simplify build and install phase - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.16 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.34 bump (rhbz#2252645) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-132702 - Update tests for Image Mode - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Convert license to SPDX. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to 0.14 - Work around a build issue on Windows (CPAN RT#125571) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filter of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Modernize spec. - Convert license to SPDX. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 0.014 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 0.014 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 rebuild - 2.58 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.57 bump (rhbz#2249036) - 2.55 bump (rhbz#2248884) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - 3.82 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 3.81 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use author-independent source URL - Classify build requirements by usage - Add runtime recommendation for Mozilla::PublicSuffix as per upstream - Simplify find command using -delete - Fix permissions verbosely - Make %files list more explicit - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.014 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use author-independent source URL - Classify build requirements by usage - Add runtime recommendation for Mozilla::PublicSuffix as per upstream - Simplify find command using -delete - Fix permissions verbosely - Make %files list more explicit - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.014 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.11 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 6.16 bump - Fix minimal version of IO::Socket::IP - Fix requires/provided modules in *tests package - 6.15 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2026-8450: send_file() shell-magic via 2-arg open() - Resolves: RHEL-184826 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 6.06 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.45 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Patch for remove warning in test - Simplify build and install phases - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update run-requires for changing the `verify_SSL` default parameter from 0 to 1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 0.088 bump (rhbz#2222007) - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update Compress::Raw::Zlib for improved compatibility with zlib-ng - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod> or release notes - Make BerkeleyDB support optional - Fix locale when use embedding Perl in C (bug #2240458) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix tests for Image Mode. Resolves: RHEL-136488 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - 2.212 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.206 bump (rhbz#2225676) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.205 bump (rhbz#2223222) - Fix CVE-2026-48962: remove use of eval in File::GlobMapper - Resolves: RHEL-180415 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - 2.212 bump - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.42 bump (rhbz#2225678) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.20 (rhbz#2256127) - Remove --no-undefined from compiler test, which is not compatible with all platforms (GH#37) - Skip t/pty_get_winsize.t tests on AIX (GH#32) - Fix patchlevel check for util.h (GH#27) - Update to 1.18 (rhbz#2251844) - Address Freebsd build issue: make function checks more robust within shared lib (GH#35) - Backport upstream patch to fix C99 compatibility issue - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - 1.15 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.14 bump (rhbz#2159835) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 20231003.0 (rhbz#2241845) - On Windows, avoid hang under IPCRUNDEBUG (GH#157) - Refresh "cpanfile" from Makefile.PL, to allow use on Windows - Normalize shebangs to /usr/bin/perl (GH#163) - Fix or skip all tests recently seen to fail on Windows - Include t/result.t in releases - Make full_result() and result() Windows behavior match non-Windows (GH#168) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Update to 0.049. - Do not apply 0001-test-and-fix-for-RT-52317-Calling-run3-garbles-STDIN.patch - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Convert License to SPDX. - Modernize spec. - Update sources sha512. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Make perl-IPC-SysV-tests package noarch - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-132904 - Update tests for Image Mode - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 4.04 - Resolves: RHEL-113624 - Fix CVE-2025-40928 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-46816 - disable optional tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Filter run-require perl(t::common.pl) (BZ#2163998) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 0.13 bump - 0.12 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.11 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Disable extra test in RHEL builds (based on https://src.fedoraproject.org/rpms/perl-List-MoreUtils-XS/pull-request/1) - Silence build-time warnings about missing bundled modules - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Upgrade to 1.33 as provided in perl-5.37.11 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - BR: glibc-langpack-en (RHBZ#2259131). - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix %patch macro - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.5018 bump (rhbz#2257058) - 0.5017 bump (rhbz#2256784) - 0.5016 bump (rhbz#2255963) - 0.5015 bump (rhbz#2239928) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.7001 bump (rhbz#2257057) - 1.7000 bump (rhbz#2255972) - 1.6013 bump (rhbz#2239929) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 1.6012 bump - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.7001 bump (rhbz#2257057) - 1.7000 bump (rhbz#2255972) - 1.6013 bump (rhbz#2239929) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 1.6012 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 rebuild - 2.003003 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.003002 bump (rhbz#2257059) - 2.003001 bump (rhbz#2255925) - 2.002001 bump (rhbz#2253770) - 2.002000 bump (rhbz#2252546) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.047 - Avoid using empty regex for backwards compatability - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.046 - Add src/ to include paths - Update to 0.045 - Fix compilation issue on Windows - Update to 0.044 - Add module sharedirs - Only add src/*.c files to primary XS file - Update to 0.043 - Restore manpage generation - Add include/ to include paths - Compile all .c files in src/ - Update to 0.041 - Manify .pod after .pm - Filter out script documentation from scripts - Don't manify podless modules/scripts - Use SPDX-format license tag - Standardize permissions of packaged files - Add fix for POD generation (GH#29) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 0.4234 bump - Use author-independent source URL - Fix permissions verbosely - Make %files list more explicit - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 0.4232 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-144358 - 5.20260119 bump - Resolves: RHEL-75799 - 5.20250120 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 rebuild - 5.20240702 bump - Bump release for June 2024 mass rebuild - 5.20240129 bump (rhbz#2261642) - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Simplify build and install phase - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Simplify build and install phase - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Simplify build and install phase - Update license to SPDX format - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Simplify build and install phases - Update license to SPDX format - Use GPL-1.0-or-later OR Artistic-1.0-Perl macro - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Simplify build and install phases - Update license to SPDX format - Use GPL-1.0-or-later OR Artistic-1.0-Perl macro - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 1.21 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove obsolete code - Package tests - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove obsolete code - Package tests - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Increase release to favour standalone package - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update to 1.000038 - Detects "class" syntax - Use SPDX-format license tag - Package tests - Fix patch macro - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix whitespace - Update license to SPDX format - Use GPL-1.0-or-later OR Artistic-1.0-Perl macro - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Fix patch macro - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix whitespace - Update license to SPDX format - Use GPL-1.0-or-later OR Artistic-1.0-Perl macro - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix provided packages in *-tests package - Package tests - Simplify build and install phases - Update license to SPDX format - Resolves: RHEL-68426 - 1.37 bump; Fix CVE-2024-10224 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.35 bump (rhbz#2248014) - Add test BR perl(AutoLoader) (rhbz#2242265) - 1.34 bump (rhbz#2240459) - 1.33 bump (rhbz#2229212) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop redundant dependency of Digest::SHA1; implementation from Digest::SHA is used instead - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.005005 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 20231213 bump - 20230821 bump - 20230807 bump - 20230801 bump - Fix %patch macro usage - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix %patch macro usage - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 6.23 bump - Fix comments in spec file (IO::Socket::INET6 is deprecated) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 2.76 as provided in perl-5.37.11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Unify to use macros - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add patch to add tests for other USM scenarios - Add patch to rewrite from Digest::SHA1 to Digest::SHA - Add patch to rewrite usage of HMAC with same dependencies - Add patch to split test files for better readability - Improve patch for switch from Socket6 to Socket - Package tests - Rename patch to better name with source dist version - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Modernize spec - Update license to SPDX format - Switch from Socket6 to Socket - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-33744 - Stop using OpenSSL ENGINE API - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.94 - Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and 3.2, and LibreSSL 3.5-3.8 - Many noisy compiler warnings have been silenced - if SSLeay.xs fails to compile, it should now be much easier to identify the cause - libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl() function are now exposed, enabling fine-grained control over the initialisation and configuration of both libraries - libssl functions implementing TLS 1.3 PSK authentication are now exposed, in particular SSL_CTX_set_psk_find_session_callback() (on the server side) and SSL_CTX_set_psk_use_session_callback() (on the client side) - libssl functions implementing server-side TLS 1.2 PSK authentication are now exposed, in particular SSL_CTX_set_psk_server_callback() - libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a TLS server to set a callback function that is executed when the server processes a ClientHello message - Many more libcrypto/libssl constants and functions are now exposed; see the release notes for the 1.93 developer releases for a full list - Rebuild for OpenSSL 3.1.1 in Rawhide - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update test suite to handle potential unavailability of sha1 algorithm https://github.com/radiator-software/p5-net-ssleay/pull/433 - Avoid deprecated patch syntax - Update license to SPDX format - Fix test suite to work with OpenSSL 3.4.0 and newer Resolves: RHEL-92601 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Resolves: RHEL-33744 - Stop using OpenSSL ENGINE API - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.94 - Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and 3.2, and LibreSSL 3.5-3.8 - Many noisy compiler warnings have been silenced - if SSLeay.xs fails to compile, it should now be much easier to identify the cause - libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl() function are now exposed, enabling fine-grained control over the initialisation and configuration of both libraries - libssl functions implementing TLS 1.3 PSK authentication are now exposed, in particular SSL_CTX_set_psk_find_session_callback() (on the server side) and SSL_CTX_set_psk_use_session_callback() (on the client side) - libssl functions implementing server-side TLS 1.2 PSK authentication are now exposed, in particular SSL_CTX_set_psk_server_callback() - libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a TLS server to set a callback function that is executed when the server processes a ClientHello message - Many more libcrypto/libssl constants and functions are now exposed; see the release notes for the 1.93 developer releases for a full list - Rebuild for OpenSSL 3.1.1 in Rawhide - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix running of tests in perl-Net-Server-tests subpackage Resolves: RHEL-65278 - Sync OpenSSL Engine patch with upstream - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-47140 - Stop using OpenSSL ENGINE API routines in SSLeay - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Package tests - Update license to SPDX format - 2.014 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix requires. - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix requires. - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.010 bump - Update %patch macro usage - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.010 bump - Update %patch macro usage - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update Compress::Raw::Zlib for improved compatibility with zlib-ng - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod> or release notes - Make BerkeleyDB support optional - Fix locale when use embedding Perl in C (bug #2240458) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Modernize spec - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 0.45 bump (rhbz#2259976) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 0.44 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.144 - Fixed tilde expansion tests where ~root expands to '/' - Update to 0.142 Deprecations - Tilde expansion is deprecated due to inconsistent and bug-prone behavior Bug fixes - Prevent expansion of tildes that are not the very first character (e.g. "./~foo") - Prevent unintentional tilde expansion during internal path processing - Escape non-tilde glob characters before tilde expansion - Fixed spew/edit to a long filename approaching the filesystem length limit - Internal calls to 'print' are checked for possible errors - Internal read calls are checked for errors Changes - Path stringification now adds "./" in front of paths starting with literal tilde so they will round-trip; FREEZE updated to use this stringification rule as well - 'move' now uses File::Copy::move internally instead of the built-in 'rename', allowing it to work across filesystems; it also returns an object for the moved location, allowing chaining - edit_lines_raw now uses a buffered raw I/O layer - edit_lines_utf8 now prefers PerlIO::utf8_strict, if available - lines_utf8 now consistently uses a buffered I/O layer - open*_utf8 now prefers PerlIO::utf8_strict, if available - slurp_utf8 now consistently uses an unbuffered I/O layer Documented - Changed all raw/UTF-8 layer descriptions in method documentation to match the code - Fixed SYNOPSIS syntax - Documented how to disable TMPDIR when making temp files/dirs Testing - Add additional tilde stringification testing - Fixed tilde expansion tests on Windows - Skip a problematic test case on Cygwin - Upgrade to 3.91 as provided in 5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 3.89 as provided in perl-5.37.11 - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Resolves: RHEL-75802 - Upgrade to 3.91 as provided in 5.40.1 version of File::Spec was updated - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Upgrade to 3.91 as provided in 5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 3.89 as provided in perl-5.37.11 - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - 1.77 bump (rhbz#2262670) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.76 bump (rhbz#2256687) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of provides/requires - Fix %patch macro. - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 3.400 bump (rhbz#2246865) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Add filter for private test module perl(helpers) - 3.45 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Filter provides from sub-package tests - Resolves: RHEL-36310 - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix patch macro - Package tests - Remove obsolete if - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 2116427 - Rebase to upstream version 1.63. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 2.038 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 2.037 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 2.036 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - 2.038 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 2.037 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Fix patch macro - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Update to 0.104006 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.104005 - Use %{make_build} and %{make_install} where appropriate - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.104004 (rhbz#2209461) - Rename Perl Artistic License to avoid confusion in detecting license - Update to 0.104003 (rhbz#2208530) - Add Artistic 1.0 Perl license and make Perl license use it - Remove extra "59" from LGPL-2.1 - Use SPDX-format license tag - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 3.32 as provided in perl-5.37.12 - Upgrade to 3.31 as provided in perl-5.37.11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 3.32 as provided in perl-5.37.12 - Upgrade to 3.31 as provided in perl-5.37.11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Spec tidy-up - Use SPDX-format license tag - Use author-independent source URL - Drop support for building with Test::More < 0.88 - Drop redundant buildroot cleaning in %install section - Use %license unconditionally - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.991 - Make the requirement for perl v5.12.0 explicit; previously, it was only implicit because of prerequisites - Update to 0.990 - Fixes to keep working in v5.39 (GH#17, GH#18) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.929 (rhbz#2157199) - Update packaging and metadata - Use SPDX-format license tag - Use %license - Fix permissions verbosely - Simplify find command using -delete - Drop redundant buildroot cleaning in %install section - Filter perl(Sub::Name) from tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.006008 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Filter perl(Sub::Name) from tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.006008 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 0.29 bump (rhbz#2222620) - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 0.28 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Spec tidy-up - Use SPDX-format license tag - Use author-independent source URL - Specify all dependencies - Fix permissions verbosely - Simplify find commands using -empty and -delete - Make %files list more explicit - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - 1.18 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Revert bundling Term::Table::HashBase, module is in Perl Core Resolves: RHEL-66303 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Disable non-core dependencies when bootstrapping a core module - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.018 bump - 0.017 bump - Fix %patch macro - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Port Configure.pm to C99 - Fix patch macro - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fix patch macro - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove not used test file - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.204 (rhbz#2159015) - Try to avoid clobbering global error variables when loading test libraries - hash_each now enumates keys in sort() order, to make errors more consistent - Update to 1.202 (rhbz#2158345) - Converted to Dist::Zilla - Test::Deep will now require v5.12, and this may go up; this change allows simplification of the Makefile.PL, which was coping with a mistake made twelve years ago - Use SPDX-format license tag - Package LICENSE file - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Improve version processing - Fix version handling for git commit checks - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.71 - Document and test different behavior regarding Booleans in perl 5.38.0 compared to earlier versions (GH#21) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.70 - Stop pointless use of taint-mode in tests, so tests pass when perl is built without taint support - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Spec tidy-up - Use SPDX-format license tag - Use author-independent source URL - Fix permissions verbosely - Simplify find command using -delete - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.017 - Update packaging and metadata - Use SPDX-format license tag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 3.48 bump (rhbz#2241802) - 3.47 bump (rhbz#2231692) - 3.46 bump (rhbz#2229823) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 1.10 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Use macros instead of variables - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 1.10 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Update license to SPDX format - Use macros instead of variables - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Update to 0.002010 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Update to 0.002010 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 1.034 bump (rhbz#2219870) - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 1.034 bump (rhbz#2219870) - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix provides in perl-Test-Pod-tests package Resolves: RHEL-68616 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Update to 1.302199 - Fix automatic detection of requires in *tests package - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Perl 5.40 rebuild - 0.000163 bump - Disable optional tests on RHEL - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.000159 bump - 0.000156 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Fix warning with undefined $unkpos (bug #2172819) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix tests for Image Mode. Resolves: RHEL-136489 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Modernize spec. - Convert license to SPDX. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Use macros make_* - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - 2024.001 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 2023.0511 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Upgrade to 1.9777 as provided in perl-5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 1.9775 as provided in perl-5.37.12 - Upgrade to 1.9774 as provided in perl-5.37.11 - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Upgrade to 1.9777 as provided in perl-5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 1.9775 as provided in perl-5.37.12 - Upgrade to 1.9774 as provided in perl-5.37.11 - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 1.35 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Resolves: RHEL-36643, RHEL-41058 - Move away from xvfb-run - Bump release for June 2024 mass rebuild - Fix failing build and tests - Resolves: RHEL-25977 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Fix %patch macro - Update license to SPDX format - Port to C99 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 5.27 bump (rhbz#2263535) - 5.26 bump (rhbz#2262451) - 5.25 bump (rhbz#2260642) - 5.24 bump (rhbz#2260409) - 5.22 bump (rhbz#2260363) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 5.21 bump (rhbz#2233885) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - CVE-2026-19953 perl-URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization hostname encoding via missing Unicode normalization Resolves: RHEL-274901 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 1.32 as provided in perl-5.37.11 - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove Requires for bash, it's autogenerated - Package tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - 2.0210 bump (rhbz#2260127) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Restore compatibility with libxml-2.12.0 (bug #2251181) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.0209 bump (rhbz#2223070) - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix out-of-bounds heap read on truncated UTF-8 sequences (CVE-2026-8177) - Resolves: RHEL-186521 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2006-10002, CVE-2006-10003 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-97464 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for fixing TMT tests without discovering dependencies - 0.39 bump - 0.38 bump - 0.37 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.74 (rhbz#2181091) - A few documentation tweaks - Use SPDX-format license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.31 (rhbz#2255994) - Update docs to recommend YAML::PP - Package description updated as per upstream documentation - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.37 bump (rhbz#2256130) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.67 bump (rhbz#2256265) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use %license unconditionally - Adapt a spec file to rpm-4.18.92 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Modernize spec - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - 0.032 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - 0.031 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.16 bump - 1.15 bump - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update Compress::Raw::Zlib for improved compatibility with zlib-ng - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod> or release notes - Make BerkeleyDB support optional - Fix locale when use embedding Perl in C (bug #2240458) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Fix patch macro - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update Compress::Raw::Zlib for improved compatibility with zlib-ng - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod> or release notes - Make BerkeleyDB support optional - Fix locale when use embedding Perl in C (bug #2240458) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 6.76 bump - 6.74 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.73 bump - 6.72 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 6.71 bump - 6.70 bump - Fix %patch macro - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update Compress::Raw::Zlib for improved compatibility with zlib-ng - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod> or release notes - Make BerkeleyDB support optional - Fix locale when use embedding Perl in C (bug #2240458) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Increase release to favour standalone package - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Update to 0.241 - Actually include the changes documented for version 0.240 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - 5.20240218 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 5.20230812 bump (rhbz#2231653) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - 5.20230701 bump (rhbz#2219017) - Package tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 5.01 bump - 5.00 bump - Package tests - AlmaLinux changes: Set x86_64 arch as exchangeable to x86_64_v2 - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for June 2024 mass rebuild - Stricten dependencies between libsolv subpackages (RHEL-38831) - Configure gating - Set x86_64 arch as exchangeable to x86_64_v2 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178270) - Cope with integer overflow in data size arithmetics in repo_add_solv() (CVE-2026-9149) (RHEL-178267) - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository (CVE-2026-9150) (RHEL-178263) - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>) - Resolves: RHEL-87185 - Resolves: RHEL-75798 - 5.40.1 bump (see <https://metacpan.org/release/SHAY/perl-5.40.1/view/pod/perldelta.pod>) - Add config.over to make build od perl reproducible - Removed unnecessary conversion - Add new systemtap-sdt-dtrace to build deps - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - 5.40.0 bump (see <https://metacpan.org/release/HAARG/perl-5.40.0/view/pod/perldelta.pod) - Subpackage Term-Table - Subpackage Test-Suite2 - Bump release for June 2024 mass rebuild - Disable using libdb for RHEL - Resolves: RHEL-33071 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fixes: CVE-2026-13221 - regcomp_study: Don't create a trie that would overflow - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>) - Resolves: RHEL-87186 - Resolves: RHEL-75798 - 5.40.1 bump (see <https://metacpan.org/release/SHAY/perl-5.40.1/view/pod/perldelta.pod>) - Add config.over to make build od perl reproducible - Removed unnecessary conversion - Add new systemtap-sdt-dtrace to build deps - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Upgrade to 1.69 as provided in perl-5.40.0-RC1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Increase release to favour standalone package - Upgrade to 1.68 as provided in perl-5.37.11 - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Increase release to favour standalone package - Upgrade to 2.40 as provided in perl-5.40.0-RC1 - Bump release for June 2024 mass rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Upgrade to 2.36 as provided in perl-5.37.11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Perl 5.40 re-rebuild of bootstrapped packages - Perl 5.40 rebuild - 0.9932 bump - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.9930 bump (rhbz#2238421) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 re-rebuild of bootstrapped packages - fix dependencies - support building with another name prefix - update to 5.1.27 - update to 5.1.26 - cleanup spec file, remove ZTS stuff and very old Obsoletes - add pie Provides - refresh configuration for new option and new default values - update to 5.1.25 - re-license spec file to CECILL-2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - rebuild for https://fedoraproject.org/wiki/Changes/php84 - update to 5.1.24 - Update to 1.3.1 (RHEL-65398) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - New upstream release (#2270095) - Use gcr-4 in gnome3 binary - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Disable qt in RHEL 10 builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.3.1 (RHEL-65398) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - New upstream release (#2270095) - Use gcr-4 in gnome3 binary - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Disable qt in RHEL 10 builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2026-14324: limit RTSP Content-Length and check allocation in RAOP client Resolves: RHEL-249305 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164826 - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update version to 1.2.1 - Fix CVE-2026-14324: limit RTSP Content-Length and check allocation in RAOP client Resolves: RHEL-249305 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164826 - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update version to 1.2.1 - Fix CVE-2026-14324: limit RTSP Content-Length and check allocation in RAOP client Resolves: RHEL-249305 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164826 - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update version to 1.2.1 - Fix CVE-2026-14324: limit RTSP Content-Length and check allocation in RAOP client Resolves: RHEL-249305 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164826 - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update version to 1.2.1 - Fix CVE-2026-14324: limit RTSP Content-Length and check allocation in RAOP client Resolves: RHEL-249305 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164826 - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update version to 1.2.1 - Fix CVE-2026-14324: limit RTSP Content-Length and check allocation in RAOP client Resolves: RHEL-249305 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164826 - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebase to 1.4.9 Resolves: RHEL-129575 - Update version to 1.4.6 Resolves: DESKTOP-1857 - Update version to 1.2.7 - Resolves: RHEL-76017 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update version to 1.2.6 - Update version to 1.2.3 - pipewire-jack-libs Requires pipewire-jack on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update version to 1.2.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionalize use of ExclusiveArch - Update top-level package to depend on servlet-initializer - Enable servlet-initializer subpackage - Remove dependency on jaxb-api2 compat package - Remove dependency on jakarta-activation1 compat package - Depend on compat jaxb-api version 2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionalize use of ExclusiveArch - Update top-level package to depend on servlet-initializer - Enable servlet-initializer subpackage - Remove dependency on jaxb-api2 compat package - Remove dependency on jakarta-activation1 compat package - Depend on compat jaxb-api version 2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionalize use of ExclusiveArch - Update top-level package to depend on servlet-initializer - Enable servlet-initializer subpackage - Remove dependency on jaxb-api2 compat package - Remove dependency on jakarta-activation1 compat package - Depend on compat jaxb-api version 2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionalize use of ExclusiveArch - Update top-level package to depend on servlet-initializer - Enable servlet-initializer subpackage - Remove dependency on jaxb-api2 compat package - Remove dependency on jakarta-activation1 compat package - Depend on compat jaxb-api version 2 - Enable build_with_btrfs on AlmaLinux 10 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - Related: RHEL-168736 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel (https://github.com/containers/podman/commit/56f1962) - fixes "Work on RHEL10.1 packaging" - Related: RHEL-80817 - update to the latest content of https://github.com/containers/podman/tree/v5.6 (https://github.com/containers/podman/commit/d46b857) - fixes "Can not find network create and rm message from podman event when set --events-backend to journald" - Related: RHEL-109790 - update to https://github.com/containers/podman/releases/tag/v5.6.0 - Related: RHEL-80817 - update to https://github.com/containers/podman/releases/tag/v5.5.2 - Related: RHEL-80817 - Remove copr related seds from spec - Related: RHEL-80817 - Enable build_with_btrfs on AlmaLinux 10 - Rebuild for CVE-2026-111943 - Resolves: RHEL-287477 - update to the latest upstream commit bd9083e0 - Resolves: RHEL-271981 - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 - update to the latest upstream commit 66780e9b - Resolves: RHEL-240087 - Rebuild for golang CVE fixes - Resolves: RHEL-229846 RHEL-240087 RHEL-241164 RHEL-241603 RHEL-241741 RHEL-241990 RHEL-242165 RHEL-242240 RHEL-250818 RHEL-251815 - rebuild for CVE-2026-33810 - Resolves: RHEL-229846 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Enable build_with_btrfs on AlmaLinux 10 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - update to https://github.com/containers/podman/releases/tag/v5.8.1 - fixes Update Podman to support TLS 1.3 configuration - Resolves: RHEL-153732 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel (https://github.com/containers/podman/commit/56f1962) - fixes "Work on RHEL10.1 packaging" - Related: RHEL-80817 - update to the latest content of https://github.com/containers/podman/tree/v5.6 (https://github.com/containers/podman/commit/d46b857) - fixes "Can not find network create and rm message from podman event when set --events-backend to journald" - Related: RHEL-109790 - Enable build_with_btrfs on AlmaLinux 10 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - update to https://github.com/containers/podman/releases/tag/v5.8.1 - fixes Update Podman to support TLS 1.3 configuration - Resolves: RHEL-153732 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - Enable build_with_btrfs on AlmaLinux 10 - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 - update to the latest upstream commit 66780e9b - Resolves: RHEL-240087 - Rebuild for golang CVE fixes - Resolves: RHEL-229846 RHEL-240087 RHEL-241164 RHEL-241603 RHEL-241741 RHEL-241990 RHEL-242165 RHEL-242240 RHEL-250818 RHEL-251815 - rebuild for CVE-2026-33810 - Resolves: RHEL-229846 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - Enable build_with_btrfs on AlmaLinux 10 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - Related: RHEL-168736 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel (https://github.com/containers/podman/commit/56f1962) - fixes "Work on RHEL10.1 packaging" - Related: RHEL-80817 - update to the latest content of https://github.com/containers/podman/tree/v5.6 (https://github.com/containers/podman/commit/d46b857) - fixes "Can not find network create and rm message from podman event when set --events-backend to journald" - Related: RHEL-109790 - update to https://github.com/containers/podman/releases/tag/v5.6.0 - Related: RHEL-80817 - update to https://github.com/containers/podman/releases/tag/v5.5.2 - Related: RHEL-80817 - Remove copr related seds from spec - Related: RHEL-80817 - Enable build_with_btrfs on AlmaLinux 10 - Rebuild for CVE-2026-111943 - Resolves: RHEL-287477 - update to the latest upstream commit bd9083e0 - Resolves: RHEL-271981 - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 - update to the latest upstream commit 66780e9b - Resolves: RHEL-240087 - Rebuild for golang CVE fixes - Resolves: RHEL-229846 RHEL-240087 RHEL-241164 RHEL-241603 RHEL-241741 RHEL-241990 RHEL-242165 RHEL-242240 RHEL-250818 RHEL-251815 - rebuild for CVE-2026-33810 - Resolves: RHEL-229846 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Enable build_with_btrfs on AlmaLinux 10 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - update to https://github.com/containers/podman/releases/tag/v5.8.1 - fixes Update Podman to support TLS 1.3 configuration - Resolves: RHEL-153732 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel (https://github.com/containers/podman/commit/56f1962) - fixes "Work on RHEL10.1 packaging" - Related: RHEL-80817 - update to the latest content of https://github.com/containers/podman/tree/v5.6 (https://github.com/containers/podman/commit/d46b857) - fixes "Can not find network create and rm message from podman event when set --events-backend to journald" - Related: RHEL-109790 - Enable build_with_btrfs on AlmaLinux 10 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - update to https://github.com/containers/podman/releases/tag/v5.8.1 - fixes Update Podman to support TLS 1.3 configuration - Resolves: RHEL-153732 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - Enable build_with_btrfs on AlmaLinux 10 - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 - update to the latest upstream commit 66780e9b - Resolves: RHEL-240087 - Rebuild for golang CVE fixes - Resolves: RHEL-229846 RHEL-240087 RHEL-241164 RHEL-241603 RHEL-241741 RHEL-241990 RHEL-242165 RHEL-242240 RHEL-250818 RHEL-251815 - rebuild for CVE-2026-33810 - Resolves: RHEL-229846 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Correct a license tag to "MIT AND LicenseRef-Fedora-Public-Domain" - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add tests for CVE-2026-42198 - Limit SCRAM PBKDF2 iterations to prevent DoS via malicious server - Resolves: RHEL-173479 - Rebase to 42.7.2 - Resolves: CVE-2024-1597 - Bundle shaded ongres-* dependencies - Fix BuildRequires - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Rebase to 42.7.2 - Resolves: CVE-2024-1597 - Bundle shaded ongres-* dependencies - Fix BuildRequires - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 16.00.0000 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 18.3 - Enable pltcl - Update gating configuration - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error - create user and group using useradd/groupadd - Update to 18.1 - Bump release for gating - Initial commit on c10s - Resolves: RHEL-116546 - Update to 18.4 - Fix CVE-2026-6478 - Update to 18.3 - Enable pltcl - Update gating configuration - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error - create user and group using useradd/groupadd - Update to 18.1 - Bump release for gating - Initial commit on c10s - Resolves: RHEL-116546 - Update to 18.6 - Fix CVE-2026-18408 - Fix CVE-2026-6464 - Update to 18.4 - Fix CVE-2026-6478 - Update to 18.3 - Enable pltcl - Update gating configuration - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error - create user and group using useradd/groupadd - Update to 18.1 - Bump release for gating - Initial commit on c10s - Resolves: RHEL-116546 - Resolves: RHEL-60823, Move potrace-devel to CRB repository - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-35824, convert license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Converted license tag to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update License to SPDX expression - Fix building with cmocka >= 1.1.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to version 1.0.1 - Patch prctl() on ppc64le - Verify packages using gpgverify - Make description line length < 80 - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Disable tests during build that are flaky - Rebuilt for tests directory - Copy patch from c9s to make emacs dependency optional Resolves: RHEL-93236 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Disable tests during build that are flaky - Rebuilt for tests directory - Copy patch from c9s to make emacs dependency optional Resolves: RHEL-93236 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Fix gating failures Resolves: RHEL-70719 - Fix build failure for s390x Resolves: RHEL-70719 - Fix gaiting failure Resolves: RHEL-70719 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop obsolete pandoc dependency - Update to 3.0.2 - Rebuild for pmix 4.1.3 - Bump release for October 2024 mass rebuild: - enable c10s gating - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.21.5 - migrate to SPDX license format - the old and new license tags are identical, this changelog entry just indicates that it was checked to be correct - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for libunistring-1.1 - Mark psl-make-dafsa noarch - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - enable c10s gating - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.21.5 - migrate to SPDX license format - the old and new license tags are identical, this changelog entry just indicates that it was checked to be correct - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for libunistring-1.1 - Mark psl-make-dafsa noarch - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Don't copy configure~ into psutils-tests package - Related: RHEL-45222 - Use bundled gnulib on RHEL - Resolves: RHEL-45222 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.10 bump - resolves: rhbz#2173614 - 2.09 bump - resolves: rhbz#2035916 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Don't copy configure~ into psutils-tests package - Related: RHEL-45222 - Use bundled gnulib on RHEL - Resolves: RHEL-45222 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.10 bump - resolves: rhbz#2173614 - 2.09 bump - resolves: rhbz#2035916 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Migrate to SPDX license expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - drop the legacy compat package (#2054527) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add padsp again (rhbz#2120847) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuild for libsndfile (#2128041) - 16.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add padsp again (rhbz#2120847) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuild for libsndfile (#2128041) - 16.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add padsp again (rhbz#2120847) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuild for libsndfile (#2128041) - 16.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add padsp again (rhbz#2120847) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuild for libsndfile (#2128041) - 16.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add padsp again (rhbz#2120847) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuild for libsndfile (#2128041) - 16.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add padsp again (rhbz#2120847) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuild for libsndfile (#2128041) - 16.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add padsp again (rhbz#2120847) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuild for libsndfile (#2128041) - 16.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add padsp again (rhbz#2120847) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - rebuild for libsndfile (#2128041) - 16.1 - Bump release for October 2024 mass rebuild: - Added gating.yaml and tests for python-cffi - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Python 3.13.0a1+ compatibility - Update to 1.16.0 - Fixes: rhbz#2240695 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update libcomps to 0.1.21 (RHEL-38831) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport upstream patch to fix C compatibility issue - Fix build with libxml2-2.12.0 - Update to 0.1.20 - Fixes of xml parsing - Fix non-optimized builds by removing inline keyword - Use Py_hash_t instead of long - Backport additional patch to fix segfault in fromxml_str - Backport patch to fix segfault in fromxml_str - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix URL and Source URL - Rebase to the latest upstream version - Update license and use SPDX formula according to fedora-license-data - https://gitlab.com/fedora/legal/fedora-license-data/-/issues/153 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebase to the latest upstream version - Resolves rhbz#2171683 - Update to 0.6.2 - Update modules to 0.4.2 Resolves: RHEL-148142 - Update to 0.6.1 - Update modules to 0.4.1 Resolves: RHEL-67667 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix CVE-2026-59886: prevent overflow in Real.__float__() when converting ASN.1 Real values with large exponents Resolves: RHEL-217904 - Update to 0.6.2 - Update modules to 0.4.2 Resolves: RHEL-148142 - Update to 0.6.1 - Update modules to 0.4.1 Resolves: RHEL-67667 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml - Set Release value explicitly - Add gating.yaml - Bump release for June 2024 mass rebuild - Add missing %{dist} to Release - Bump release number - Remove benchmarking files from package - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for inclusion of the package in CRB10 - Add gating.yaml and tests - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.10.0 and switch to pyproject macros; Fixes: RHBZ#1747105 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - [ci] Configure CI tests and gating.yaml - Disable all extras in RHEL builds - Don’t build asyncmy extra package on x86 (32bit) - Update to 2.0.26 - Generate build requirements for extra packages - Avoid mypy dependency in RHEL builds - Upgrade to 2.0.25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Don't recommend python-systemd-doc which pulls in 3 packages - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - BuildRequire python3-setuptools explicitly - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 6.5.10 Resolves: RHEL-274866 - Update to 6.5.8 Resolves: RHEL-247266 - Update to 6.5.5 Resolves: RHEL-160935 - httputil: Raise errors instead of logging in multipart/form-data parsing Resolves: RHEL-91992 - Update to 6.4.2 Resolves: RHEL-68668 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 6.5.5 Resolves: RHEL-160935 - httputil: Raise errors instead of logging in multipart/form-data parsing Resolves: RHEL-91992 - Update to 6.4.2 Resolves: RHEL-68668 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Increase timeout for tests on riscv64 - Update to 6.5.8 Resolves: RHEL-247266 - Update to 6.5.5 Resolves: RHEL-160935 - httputil: Raise errors instead of logging in multipart/form-data parsing Resolves: RHEL-91992 - Update to 6.4.2 Resolves: RHEL-68668 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - [ci] Configure CI tests and gating.yaml - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.13.1 (Fixes RHBZ#2255427) - Update to 1.13.0 (Fixes RHBZ#2252423) - Update to 1.12.1 (Fixes RHBZ#2246418) - Update to 1.12.0 (Fixes RHBZ#2236554) - Update to 1.11.3 (Fixes RHBZ#2232407) - Update to 1.11.2 (Fixes RHBZ#2229186) - Bump release for June 2024 mass rebuild - [ci] Configure CI tests and gating.yaml - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.13.1 (Fixes RHBZ#2255427) - Update to 1.13.0 (Fixes RHBZ#2252423) - Update to 1.12.1 (Fixes RHBZ#2246418) - Update to 1.12.0 (Fixes RHBZ#2236554) - Update to 1.11.3 (Fixes RHBZ#2232407) - Update to 1.11.2 (Fixes RHBZ#2229186) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - new upstream release https://github.com/praiskup/argparse-manpage/releases/tag/v4.4 - new upstream release: https://github.com/praiskup/argparse-manpage/releases/tag/v4.4 - license tag in SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - new upstream release, tomli dep instead of toml https://github.com/praiskup/argparse-manpage/releases/tag/v4.3 - new upstream release, upport for pyproject.toml specs, and --manfile option - new `--include` feature, inspired by `help2man --include` - allow overriding build date with SOURCE_DATE_EPOCH environment variable - the AUTHORS section was changed to more standard AUTHOR - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - new upstream release https://github.com/praiskup/argparse-manpage/releases/tag/v4.4 - new upstream release: https://github.com/praiskup/argparse-manpage/releases/tag/v4.4 - license tag in SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - new upstream release, tomli dep instead of toml https://github.com/praiskup/argparse-manpage/releases/tag/v4.3 - new upstream release, upport for pyproject.toml specs, and --manfile option - new `--include` feature, inspired by `help2man --include` - allow overriding build date with SOURCE_DATE_EPOCH environment variable - the AUTHORS section was changed to more standard AUTHOR - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Assert %pyproject_files contains a license file - Remove an obsolete conditional - Simplify the spec file by reducing macro indirection - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update License to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Mark this as SPDX license expression converted - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 9.0.0 version (#2137734) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - bluez5: Fix invalid arguments to PairDevice (thanks Simon McVittie) - bluez: Clean up static default properties, re-drop PairDevice() `class_` parameter - Add pre-commit rules (thanks Peter Hutterer) - api: Add pytest support and helpers - api: Factor the server spawning into a new SpawnedMock object (thanks Peter Hutterer) - doc: generate sphinx docs on https://martinpitt.github.io/python-dbusmock/ (thanks Peter Hutterer) - cli: Add support for running custom commands on the mock environment (thanks Marco Trevisan) - spec: Update License: to SPDX format - Test fixes (thanks Marco Trevisan) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Support loading templates from XDG_DATA_DIRS - iio-sensors-proxy: Throw proper D-Bus errors instead of Python Exception - Rebase to 2.6.1 Resolves: RHEL-32661, RHEL-32667 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.5.0 (rhbz#2257079) - Relax upper bound on trio dependency - Update to 2.4.2 (rhbz#2230509) - Update to 2.4.1 (rhbz#2219703) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Rebase to 2.6.1 Resolves: RHEL-32661, RHEL-32667 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.5.0 (rhbz#2257079) - Relax upper bound on trio dependency - Update to 2.4.2 (rhbz#2230509) - Update to 2.4.1 (rhbz#2219703) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.5 (close RHBZ#2225249) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - When we don’t build PDF docs, don’t build a -doc subpacakge at all - Disable docs by default in RHEL builds - Update to 0.4 (close RHBZ#2220948) - Upstream switched from setuptools to flit_core: pyproject-rpm-macros no longer handles LICENSE.txt - Add a -doc subpackage with PDF documentations - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Resolves: RHEL-38996 - Generate extra subpackages only for Fedora release - Update to 4.51.0 version (#2273774) - Resolves: RHEL-31499 - Update to 4.50.0 version - Update to 4.49.0 version (#2264616) - Update to 4.48.1 version (#2263197) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Remove version limit from lxml - Update to 4.47.2 version (#2257911) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Help msuchy to count this package as already using SPDX license expression - Rebuilt for Python 3.12 - Disable tests in RHEL builds - Update to 2.4.16 version - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild to force gating to use new gating config (changed genisoimage to xorriso for tests) - New Version 1.2.5 (bcl) Resolves: RHEL-45005 - testpyisomd5sum.py: Use a consistent iso size (bcl) - Remove quiet from iso creation, size seems wrong (bcl) - workflows: Move to Fedora 39 and checkout v4 (bcl) - Add support for riscv64 (davidlt) - workflows: Update to use actions/checkout (bcl) - Add a GitHub Action to run tests (bcl) - Add mips64 (wangray1021) - testpyisomd5sum.py: Support genisoimage, Python 2 (ryan) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop unneeded build dependencies - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2023.11.2 (rhbz#2252278) - Update to 2023.11.1 (rhbz#2249692) - Initial package. - Rebase to 1.1.3 Resolves: RHEL-127169 - Bump release for CRB inclusion Resolves: RHEL-96893 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Review fixes - Update to the latest upstream version (RHEL-132576) - Add a weak dependency to intel-vsc-firmware - Drop the lttng-ust dependency - Disable tracing - Disable lc-compliance - Removed the gtest dependency from the libcamera-tools package - Resolves: RHEL-73503 - Update to 0.3.2 - Add Recommends: libcamera-ipa to the main package - Add patches to fix pipewire keeping UVC cameras open all the time causing significant laptop battery drain: https://gitlab.freedesktop.org/pipeawire/pipewire/-/issues/2669 - Enable simple pipeline everywhere - Update to 0.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix description of python3-libpamtest - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update License to SPDX expression - Fix building with cmocka >= 1.1.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Release version 2.17.14 (Michal Srb) - reporter-bugzilla: Reduce number of duplicate bug reports (Michal Srb) - reporter-bugzilla: Fix config loading (Michal Srb) - reporter-bugzilla: API key must consist of latin-1 characters (Michal Srb) - reporter-bugzilla: Fix typo (Michal Srb) - reporter-bugzilla: Fix creating binary attachments (Michal Srb) - Update translations (mgrabovsky) - Release version 2.17.13 (Michal Srb) - Exclude coredump archives when creating a bug (Michal Srb) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Release version 2.17.11 (Michal Srb) - spec: Add missing requires for python3-libreport (Michal Srb) - Build URL with urllib.parse.urljoin() (Michal Srb) - Add XDG_ACTIVATION_TOKEN to the list of ignored words (Michal Srb) - Attachments are minor updates in Bugzilla (Michal Srb) - Retry Bugzilla search queries with delays (Michal Srb) - Fix "NameError: name 'ticket' is not defined" exception (Michal Srb) - Update translations (mgrabovsky) - Rebuilt for Python 3.12 - create temporary edit files at symlink target location (RHEL-85247) - rebuild, fix FTBFS (#RHEL-65455) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.1.39 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - 1.1.38 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 1.1.37 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - New upstream release - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Remove patchelf dependency for RHEL - Omit pytest-mock test dependency and associated tests on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop unused python-build dependency - Update to 0.15.0 (close RHBZ#2246309) - Update to 0.14.0 (close RHBZ#2237380) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use new (rpm 4.17.1+) bcond style - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Conditionalize docs - New upstream release 0.10.1 (rhbz#2256342) - Remove patch for Python 3.13 compatibility (merged upstream in 0.10.0) - Add new depencency on furo - Include missing THANKS file (https://github.com/netaddr/netaddr/pull/345) - Add patch for Python 3.13 compatibility (rhbz#2246093) - New upstream release 0.9.0 (rhbz#2239532) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Cleanup spec - Use SPDX License tag - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - fix ppc64le test failures (RHEL-77878) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - remove redundant patchelf dependency (RHEL-36334) - Unbundle libdivide in Fedora - Let libdivide use vector instructions when possible - 1.26.4 - Fix tests for IEEE long double on PPC (RHEL-145970) - fix ppc64le test failures (RHEL-77878) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix tests to handle Python 3.13 stripping indents from docstrings - Fixes RHBZ#2247031 - F38+: Use %{py3_test_envvars} to run tests - Set the same environment variables for nose2 and unittest as for pytest when testing with different runners - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Remove the usage of assertRaisesRegexp unit test alias removed in Python 3.12 - Update to 0.9.0 (close RHBZ#2181939) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update License field to SPDX - Drop dependency on deprecated python-nose - Port to pyproject-rpm-macros - Update to 2.1.8 (rhbz#2255960) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.1.7 (rhbz#2242730) - Update to 2.1.6 (rhbz#2235604) - Update to 2.1.5 (rhbz#2230229) - Update to 2.1.4 (rhbz#2213464) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 2.0.7 (rhbz#2203716) - SPDX license - Update to 2.0.6 (rhbz#2185582) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - update to https://github.com/containers/podman-py/releases/tag/v5.7.0 - Related: RHEL-122178 - update to https://github.com/containers/podman-py/releases/tag/v5.6.0 - Related: RHEL-111917 - update to https://github.com/containers/podman-py/releases/tag/v5.5.0 - Related: RHEL-80817 - update to https://github.com/containers/podman-py/releases/tag/v5.4.0.1 - Resolves: RHEL-81950 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix URL and Source URL - Rebase to the latest upstream version - Update license and use SPDX formula according to fedora-license-data - https://gitlab.com/fedora/legal/fedora-license-data/-/issues/153 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebase to the latest upstream version - Resolves rhbz#2171683 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix URL and Source URL - Rebase to the latest upstream version - Update license and use SPDX formula according to fedora-license-data - https://gitlab.com/fedora/legal/fedora-license-data/-/issues/153 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebase to the latest upstream version - Resolves rhbz#2171683 - Bump release for June 2024 mass rebuild - Rebuild for RHEL10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Mark this as SPDX license expression converted - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add gating.yaml - Set Release value explicitly - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Drop an unused build requirement on pytest-cov - Rebuilt for Python 3.12 - Dynamically generate BuildRequires - Version 0.7.1 - Drop packaging workaround, resolved upstream - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Work around FTI due to version of packaging (rhbz#2161981) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Version 4.0.0 (#2137873) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Assert that a license file is present in the .dist-info directory - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add gating - Changes to support python 3.12 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add gating.yaml - Bump release for June 2024 mass rebuild - Add missing %{dist} to Release - Bump release number - Remove benchmarking files from package - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - AlmaLinux change: Sort the changelog entries after merging to ensure the correct order of the changelog - AlmaLinux change: Added AlmaLinux change identifier - Bump release for October 2024 mass rebuild: - Update to 0.6.5 - Install man page - Bump release for June 2024 mass rebuild - Update to 0.6.1 - Update to 0.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.5.1 - Update to 0.1.5 - Rebuilt for Python 3.13 - Cope with undefined %py_dist_name - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.1.4 - Update to 0.1.3 - Update to 0.1.2 - Always disable test coverage checks - Don’t generate build requires on EL <= 9 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rebase to new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to sanlock-3.8.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuild - Update to 0.43 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19) - Update to 0.42 - Resolves: rhbz#2168223 - Update to 0.41 - Resolves: rhbz#2168223 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck results: --skip-implicit-values - Resolves: RHEL-33519 - Waive annocheck results: --skip-fortify and --skip-lto - Resolves: RHEL-33519 - rebuilt - Waive annocheck results: --skip-fortify and --skip-lto - Resolves: RHEL-33519 - Bump release for June 2024 mass rebuild - Fix python-pooch not fully removed - Resolves: RHEL-35429 - Enable riscv64 - Remove python-pooch optional dependency from RHEL - Related: RHELMISC-5321 - Build without pythran in RHEL by default - Resolves: RHEL-33955 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to version 2.4.3 - resolves: RHEL-89875 - Reformat - Bump release for June 2024 mass rebuild - rhbz#2260954 - libtalloc-2.4.2 is available - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rhbz#2224330 - libtalloc-2.4.1 is available - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - On Python 3.11+, do not BuildRequire python3-tomli for tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix parameters for specifying the target user (frostyx@email.cz) - Fix querying RPM files on EPEL7 (frostyx@email.cz) - Use backported lru_cache on EPEL7 (frostyx@email.cz) - Don't hang forever when executed via SSH (frostyx@email.cz) - Don't check if package is installed before listing its files (frostyx@email.cz) - Replace regexes where they are not needed (frostyx@email.cz) - Query all packages at once, its faster than one by one (frostyx@email.cz) - Cache some properties for a massive performance boost (frostyx@email.cz) - Refactor unnecessary condition (frostyx@email.cz) - Fix weird indentation (frostyx@email.cz) - Pass the whole application to the provided_by function, not just its name (frostyx@email.cz) - Stop using deprecated rpm.fi (frostyx@email.cz) - Attempt to fix readthedocs deprecation error (frostyx@email.cz) - More reliable check if /usr/lib/sysimage/dnf/ database should be used (frostyx@email.cz) - Rather create a /run/reboot-required not /var/run/reboot-required (frostyx@email.cz) - Update license to SPDX (frostyx@email.cz) - Update tito releasers (frostyx@email.cz) - Create /var/run/reboot-required file (frostyx@email.cz) - Recommend the correct command for restarting auditd (frostyx@email.cz) - Add python3-setuptools dependency (frostyx@email.cz) - Fix argument passed to print_helper() (ferdnyc@gmail.com) - Add similar software to the readme (frostyx@email.cz) - Update url references to point to tracer.readthedocs.io (dcampano@gmail.com) - Oracle Linux 8 uses dnf, too (suttner@atix.de) - Drop python-setuptools runtime dependency (frostyx@email.cz) - Fix Python DeprecationWarning: invalid escape sequence (jvanderwaa@redhat.com) - Add readthedocs configuration file (frostyx@email.cz) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - update to bugfix release 25.7.3 - update to bugfix release 25.7.2 - update to 25.7, switch to pyproject rpm macros - rebase to version 25.4.1 - specfile: do not use %{_libdir} - rebase to 25.3, split virt-sb-certs sub-rpm - update to version 24.11 - Bump release for October 2024 mass rebuild: - update to version 24.7 - sync gating with rhel-9 - bump release to have higher NVR than EPEL 10.0 (RHEL-133018) - rebase to 0.23.0, kudos to Dominik Mierzejewski from Fedora! (RHEL-133018) - unretire python-ztandard (RHEL-122724) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166007] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166007] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166007] - kvm-scsi-change-buf_size-to-unsigned-int-in-scsi_SG_IO.patch [RHEL-166033] - kvm-scsi-handle-reservation-changes-across-migration.patch [RHEL-166033] - Resolves: RHEL-166007 (live migration failed the VM just register key only [rhel-10.2.z]) - Resolves: RHEL-166033 (live migration failed or get failed WSFC test result during WSFC testing [rhel-10.2.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164536] - Resolves: RHEL-164536 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-10.2.z]) - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-79118] - kvm-curl-Fix-coroutine-waking.patch [RHEL-79118] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-79118] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-79118] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-79118] - kvm-net-bundle-all-offloads-in-a-single-struct.patch [RHEL-143785] - kvm-linux-headers-deal-with-counted_by-annotation.patch [RHEL-143785] - kvm-linux-headers-Update-to-Linux-v6.17-rc1.patch [RHEL-143785] - kvm-virtio-introduce-extended-features-type.patch [RHEL-143785] - kvm-virtio-serialize-extended-features-state.patch [RHEL-143785] - kvm-virtio-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-virtio-pci-implement-support-for-extended-features.patch [RHEL-143785] - kvm-vhost-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-qmp-update-virtio-features-map-to-support-extended-f.patch [RHEL-143785] - kvm-vhost-backend-implement-extended-features-support.patch [RHEL-143785] - kvm-vhost-net-implement-extended-features-support.patch [RHEL-143785] - kvm-virtio-net-implement-extended-features-support.patch [RHEL-143785] - kvm-net-implement-tunnel-probing.patch [RHEL-143785] - kvm-net-implement-UDP-tunnel-features-offloading.patch [RHEL-143785] - Resolves: RHEL-79118 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled [rhel10]) - Resolves: RHEL-143785 (backport support for GSO over UDP tunnel offload) - kvm-fix-pc_rhel_10_2_compat_len.patch [RHEL-126707] - kvm-q35-increase-default-tseg-size.patch [RHEL-126707] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-139028] - kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch [RHEL-111853] - Resolves: RHEL-126707 ([qemu, rhel-10] increase default TSEG size) - Resolves: RHEL-139028 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-10.2]) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] - Resolves: RHEL-108142 (QEMU crashes when stopping source VM during live migration) - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207389] - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207389] - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207389] - Resolves: RHEL-207389 (qemu-img create/convert fails on target block device with 4k sector size [rhel-10.2.z]) - kvm-blkdebug-Add-delay-ns-option.patch [RHEL-190702] - kvm-block-Add-blk_co_start-end_request-and-BDRV_REQ_NO_Q.patch [RHEL-190702] - kvm-block-Add-flags-parameter-to-blk_-_pdiscard.patch [RHEL-190702] - kvm-ide-Minimal-fix-for-deadlock-between-TRIM-and-drain.patch [RHEL-190702] - kvm-ide-Clean-up-ide_trim_co_entry-to-be-idiomatic-corou.patch [RHEL-190702] - kvm-ide-test-Factor-out-wait_dma_completion.patch [RHEL-190702] - kvm-ide-test-Test-reset-during-TRIM.patch [RHEL-190702] - kvm-spec-Install-qtests-into-qemu-kvm-tests-package.patch [RHEL-190702] - Resolves: RHEL-190702 (qemu-kvm hung during drain after double pause [rhel-10.2.z]) - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184529] - Resolves: RHEL-184529 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-10.2.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166007] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166007] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166007] - kvm-scsi-change-buf_size-to-unsigned-int-in-scsi_SG_IO.patch [RHEL-166033] - kvm-scsi-handle-reservation-changes-across-migration.patch [RHEL-166033] - Resolves: RHEL-166007 (live migration failed the VM just register key only [rhel-10.2.z]) - Resolves: RHEL-166033 (live migration failed or get failed WSFC test result during WSFC testing [rhel-10.2.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164536] - Resolves: RHEL-164536 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-10.2.z]) - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-79118] - kvm-curl-Fix-coroutine-waking.patch [RHEL-79118] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-79118] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-79118] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-79118] - kvm-net-bundle-all-offloads-in-a-single-struct.patch [RHEL-143785] - kvm-linux-headers-deal-with-counted_by-annotation.patch [RHEL-143785] - kvm-linux-headers-Update-to-Linux-v6.17-rc1.patch [RHEL-143785] - kvm-virtio-introduce-extended-features-type.patch [RHEL-143785] - kvm-virtio-serialize-extended-features-state.patch [RHEL-143785] - kvm-virtio-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-virtio-pci-implement-support-for-extended-features.patch [RHEL-143785] - kvm-vhost-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-qmp-update-virtio-features-map-to-support-extended-f.patch [RHEL-143785] - kvm-vhost-backend-implement-extended-features-support.patch [RHEL-143785] - kvm-vhost-net-implement-extended-features-support.patch [RHEL-143785] - kvm-virtio-net-implement-extended-features-support.patch [RHEL-143785] - kvm-net-implement-tunnel-probing.patch [RHEL-143785] - kvm-net-implement-UDP-tunnel-features-offloading.patch [RHEL-143785] - Resolves: RHEL-79118 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled [rhel10]) - Resolves: RHEL-143785 (backport support for GSO over UDP tunnel offload) - kvm-fix-pc_rhel_10_2_compat_len.patch [RHEL-126707] - kvm-q35-increase-default-tseg-size.patch [RHEL-126707] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-139028] - kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch [RHEL-111853] - Resolves: RHEL-126707 ([qemu, rhel-10] increase default TSEG size) - Resolves: RHEL-139028 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-10.2]) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] - Resolves: RHEL-108142 (QEMU crashes when stopping source VM during live migration) - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-134212] - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-110003] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-110003] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-110003] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-110003] - kvm-rh-configs-enable-CONFIG_TDX-for-x86_64.patch [RHEL-111853] - Resolves: RHEL-134212 ([RHEL10.2] L1VH qemu downstream initial merge RHEL10.2) - Resolves: RHEL-110003 (Expose block limits of block nodes in QMP and qemu-img) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-backend-Fix-race-when-resuming-queued-requests.patch [RHEL-129540] - kvm-file-posix-Handle-suspended-dm-multipath-better-for-.patch [RHEL-121543] - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-134212] - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-134212] - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-134212] - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-134212] - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-134212] - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-134212] - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-134212] - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-134212] - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-134212] - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-134212] - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-134212] - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-134212] - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-134212] - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-134212] - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-134212] - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-134212] - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-134212] - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-134212] - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-134212] - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-134212] - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-134212] - kvm-docs-Add-mshv-to-documentation.patch [RHEL-134212] - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-134212] - kvm-accel-mshv-initialize-thread-name.patch [RHEL-134212] - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-134212] - Resolves: RHEL-129540 (Assertion failure on drain with iothread and I/O load) - Resolves: RHEL-121543 (The VM hit io error when do S3-PR integration on the pass-through failover multipath device) - Resolves: RHEL-134212 ([RHEL10.2] L1VH qemu downstream initial merge RHEL10.2) - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166007] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166007] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166007] - kvm-scsi-change-buf_size-to-unsigned-int-in-scsi_SG_IO.patch [RHEL-166033] - kvm-scsi-handle-reservation-changes-across-migration.patch [RHEL-166033] - Resolves: RHEL-166007 (live migration failed the VM just register key only [rhel-10.2.z]) - Resolves: RHEL-166033 (live migration failed or get failed WSFC test result during WSFC testing [rhel-10.2.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164536] - Resolves: RHEL-164536 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-10.2.z]) - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-79118] - kvm-curl-Fix-coroutine-waking.patch [RHEL-79118] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-79118] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-79118] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-79118] - kvm-net-bundle-all-offloads-in-a-single-struct.patch [RHEL-143785] - kvm-linux-headers-deal-with-counted_by-annotation.patch [RHEL-143785] - kvm-linux-headers-Update-to-Linux-v6.17-rc1.patch [RHEL-143785] - kvm-virtio-introduce-extended-features-type.patch [RHEL-143785] - kvm-virtio-serialize-extended-features-state.patch [RHEL-143785] - kvm-virtio-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-virtio-pci-implement-support-for-extended-features.patch [RHEL-143785] - kvm-vhost-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-qmp-update-virtio-features-map-to-support-extended-f.patch [RHEL-143785] - kvm-vhost-backend-implement-extended-features-support.patch [RHEL-143785] - kvm-vhost-net-implement-extended-features-support.patch [RHEL-143785] - kvm-virtio-net-implement-extended-features-support.patch [RHEL-143785] - kvm-net-implement-tunnel-probing.patch [RHEL-143785] - kvm-net-implement-UDP-tunnel-features-offloading.patch [RHEL-143785] - Resolves: RHEL-79118 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled [rhel10]) - Resolves: RHEL-143785 (backport support for GSO over UDP tunnel offload) - kvm-fix-pc_rhel_10_2_compat_len.patch [RHEL-126707] - kvm-q35-increase-default-tseg-size.patch [RHEL-126707] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-139028] - kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch [RHEL-111853] - Resolves: RHEL-126707 ([qemu, rhel-10] increase default TSEG size) - Resolves: RHEL-139028 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-10.2]) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] - Resolves: RHEL-108142 (QEMU crashes when stopping source VM during live migration) - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207389] - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207389] - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207389] - Resolves: RHEL-207389 (qemu-img create/convert fails on target block device with 4k sector size [rhel-10.2.z]) - kvm-blkdebug-Add-delay-ns-option.patch [RHEL-190702] - kvm-block-Add-blk_co_start-end_request-and-BDRV_REQ_NO_Q.patch [RHEL-190702] - kvm-block-Add-flags-parameter-to-blk_-_pdiscard.patch [RHEL-190702] - kvm-ide-Minimal-fix-for-deadlock-between-TRIM-and-drain.patch [RHEL-190702] - kvm-ide-Clean-up-ide_trim_co_entry-to-be-idiomatic-corou.patch [RHEL-190702] - kvm-ide-test-Factor-out-wait_dma_completion.patch [RHEL-190702] - kvm-ide-test-Test-reset-during-TRIM.patch [RHEL-190702] - kvm-spec-Install-qtests-into-qemu-kvm-tests-package.patch [RHEL-190702] - Resolves: RHEL-190702 (qemu-kvm hung during drain after double pause [rhel-10.2.z]) - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184529] - Resolves: RHEL-184529 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-10.2.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166007] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166007] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166007] - kvm-scsi-change-buf_size-to-unsigned-int-in-scsi_SG_IO.patch [RHEL-166033] - kvm-scsi-handle-reservation-changes-across-migration.patch [RHEL-166033] - Resolves: RHEL-166007 (live migration failed the VM just register key only [rhel-10.2.z]) - Resolves: RHEL-166033 (live migration failed or get failed WSFC test result during WSFC testing [rhel-10.2.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164536] - Resolves: RHEL-164536 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-10.2.z]) - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-79118] - kvm-curl-Fix-coroutine-waking.patch [RHEL-79118] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-79118] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-79118] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-79118] - kvm-net-bundle-all-offloads-in-a-single-struct.patch [RHEL-143785] - kvm-linux-headers-deal-with-counted_by-annotation.patch [RHEL-143785] - kvm-linux-headers-Update-to-Linux-v6.17-rc1.patch [RHEL-143785] - kvm-virtio-introduce-extended-features-type.patch [RHEL-143785] - kvm-virtio-serialize-extended-features-state.patch [RHEL-143785] - kvm-virtio-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-virtio-pci-implement-support-for-extended-features.patch [RHEL-143785] - kvm-vhost-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-qmp-update-virtio-features-map-to-support-extended-f.patch [RHEL-143785] - kvm-vhost-backend-implement-extended-features-support.patch [RHEL-143785] - kvm-vhost-net-implement-extended-features-support.patch [RHEL-143785] - kvm-virtio-net-implement-extended-features-support.patch [RHEL-143785] - kvm-net-implement-tunnel-probing.patch [RHEL-143785] - kvm-net-implement-UDP-tunnel-features-offloading.patch [RHEL-143785] - Resolves: RHEL-79118 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled [rhel10]) - Resolves: RHEL-143785 (backport support for GSO over UDP tunnel offload) - kvm-fix-pc_rhel_10_2_compat_len.patch [RHEL-126707] - kvm-q35-increase-default-tseg-size.patch [RHEL-126707] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-139028] - kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch [RHEL-111853] - Resolves: RHEL-126707 ([qemu, rhel-10] increase default TSEG size) - Resolves: RHEL-139028 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-10.2]) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] - Resolves: RHEL-108142 (QEMU crashes when stopping source VM during live migration) - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-134212] - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-110003] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-110003] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-110003] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-110003] - kvm-rh-configs-enable-CONFIG_TDX-for-x86_64.patch [RHEL-111853] - Resolves: RHEL-134212 ([RHEL10.2] L1VH qemu downstream initial merge RHEL10.2) - Resolves: RHEL-110003 (Expose block limits of block nodes in QMP and qemu-img) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-backend-Fix-race-when-resuming-queued-requests.patch [RHEL-129540] - kvm-file-posix-Handle-suspended-dm-multipath-better-for-.patch [RHEL-121543] - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-134212] - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-134212] - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-134212] - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-134212] - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-134212] - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-134212] - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-134212] - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-134212] - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-134212] - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-134212] - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-134212] - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-134212] - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-134212] - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-134212] - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-134212] - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-134212] - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-134212] - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-134212] - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-134212] - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-134212] - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-134212] - kvm-docs-Add-mshv-to-documentation.patch [RHEL-134212] - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-134212] - kvm-accel-mshv-initialize-thread-name.patch [RHEL-134212] - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-134212] - Resolves: RHEL-129540 (Assertion failure on drain with iothread and I/O load) - Resolves: RHEL-121543 (The VM hit io error when do S3-PR integration on the pass-through failover multipath device) - Resolves: RHEL-134212 ([RHEL10.2] L1VH qemu downstream initial merge RHEL10.2) - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166007] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166007] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166007] - kvm-scsi-change-buf_size-to-unsigned-int-in-scsi_SG_IO.patch [RHEL-166033] - kvm-scsi-handle-reservation-changes-across-migration.patch [RHEL-166033] - Resolves: RHEL-166007 (live migration failed the VM just register key only [rhel-10.2.z]) - Resolves: RHEL-166033 (live migration failed or get failed WSFC test result during WSFC testing [rhel-10.2.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164536] - Resolves: RHEL-164536 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-10.2.z]) - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-79118] - kvm-curl-Fix-coroutine-waking.patch [RHEL-79118] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-79118] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-79118] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-79118] - kvm-net-bundle-all-offloads-in-a-single-struct.patch [RHEL-143785] - kvm-linux-headers-deal-with-counted_by-annotation.patch [RHEL-143785] - kvm-linux-headers-Update-to-Linux-v6.17-rc1.patch [RHEL-143785] - kvm-virtio-introduce-extended-features-type.patch [RHEL-143785] - kvm-virtio-serialize-extended-features-state.patch [RHEL-143785] - kvm-virtio-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-virtio-pci-implement-support-for-extended-features.patch [RHEL-143785] - kvm-vhost-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-qmp-update-virtio-features-map-to-support-extended-f.patch [RHEL-143785] - kvm-vhost-backend-implement-extended-features-support.patch [RHEL-143785] - kvm-vhost-net-implement-extended-features-support.patch [RHEL-143785] - kvm-virtio-net-implement-extended-features-support.patch [RHEL-143785] - kvm-net-implement-tunnel-probing.patch [RHEL-143785] - kvm-net-implement-UDP-tunnel-features-offloading.patch [RHEL-143785] - Resolves: RHEL-79118 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled [rhel10]) - Resolves: RHEL-143785 (backport support for GSO over UDP tunnel offload) - kvm-fix-pc_rhel_10_2_compat_len.patch [RHEL-126707] - kvm-q35-increase-default-tseg-size.patch [RHEL-126707] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-139028] - kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch [RHEL-111853] - Resolves: RHEL-126707 ([qemu, rhel-10] increase default TSEG size) - Resolves: RHEL-139028 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-10.2]) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] - Resolves: RHEL-108142 (QEMU crashes when stopping source VM during live migration) - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207389] - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207389] - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207389] - Resolves: RHEL-207389 (qemu-img create/convert fails on target block device with 4k sector size [rhel-10.2.z]) - kvm-blkdebug-Add-delay-ns-option.patch [RHEL-190702] - kvm-block-Add-blk_co_start-end_request-and-BDRV_REQ_NO_Q.patch [RHEL-190702] - kvm-block-Add-flags-parameter-to-blk_-_pdiscard.patch [RHEL-190702] - kvm-ide-Minimal-fix-for-deadlock-between-TRIM-and-drain.patch [RHEL-190702] - kvm-ide-Clean-up-ide_trim_co_entry-to-be-idiomatic-corou.patch [RHEL-190702] - kvm-ide-test-Factor-out-wait_dma_completion.patch [RHEL-190702] - kvm-ide-test-Test-reset-during-TRIM.patch [RHEL-190702] - kvm-spec-Install-qtests-into-qemu-kvm-tests-package.patch [RHEL-190702] - Resolves: RHEL-190702 (qemu-kvm hung during drain after double pause [rhel-10.2.z]) - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184529] - Resolves: RHEL-184529 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-10.2.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166007] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166007] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166007] - kvm-scsi-change-buf_size-to-unsigned-int-in-scsi_SG_IO.patch [RHEL-166033] - kvm-scsi-handle-reservation-changes-across-migration.patch [RHEL-166033] - Resolves: RHEL-166007 (live migration failed the VM just register key only [rhel-10.2.z]) - Resolves: RHEL-166033 (live migration failed or get failed WSFC test result during WSFC testing [rhel-10.2.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164536] - Resolves: RHEL-164536 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-10.2.z]) - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - Enable QXL device build - Enable building for ppc64le - Re-added Spice support - Don't remove slof.bin for ppc64le - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-158224] - Resolves: RHEL-158224 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-10.2]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155601] - Resolves: RHEL-155601 (Mirror job can miss writes during startup, corrupting the copy [rhel-10.2]) - kvm-hw-uefi-add-variable-digest-to-vmstate.patch [RHEL-153058] - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-144004] - Resolves: RHEL-153058 (Qemu crashes with "double free" during restore --reset-nvram with uefi-vars secure boot) - Resolves: RHEL-144004 ([rhel-10] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147425] - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-132749] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-132749] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-132749] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-132749] - kvm-Revert-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-f.patch [RHEL-134989 RHEL-146584] - Resolves: RHEL-147425 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-132749 (Migrate SCSI PR state and preempt reservation upon live migration) - Resolves: RHEL-134989 (Hotplugged interface device can not be shown in the guest) - Resolves: RHEL-146584 ([RHEL-10.2][ARM]: Unable to Check the mem prefetched size on Guest) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-79118] - kvm-curl-Fix-coroutine-waking.patch [RHEL-79118] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-79118] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-79118] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-79118] - kvm-net-bundle-all-offloads-in-a-single-struct.patch [RHEL-143785] - kvm-linux-headers-deal-with-counted_by-annotation.patch [RHEL-143785] - kvm-linux-headers-Update-to-Linux-v6.17-rc1.patch [RHEL-143785] - kvm-virtio-introduce-extended-features-type.patch [RHEL-143785] - kvm-virtio-serialize-extended-features-state.patch [RHEL-143785] - kvm-virtio-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-virtio-pci-implement-support-for-extended-features.patch [RHEL-143785] - kvm-vhost-add-support-for-negotiating-extended-features.patch [RHEL-143785] - kvm-qmp-update-virtio-features-map-to-support-extended-f.patch [RHEL-143785] - kvm-vhost-backend-implement-extended-features-support.patch [RHEL-143785] - kvm-vhost-net-implement-extended-features-support.patch [RHEL-143785] - kvm-virtio-net-implement-extended-features-support.patch [RHEL-143785] - kvm-net-implement-tunnel-probing.patch [RHEL-143785] - kvm-net-implement-UDP-tunnel-features-offloading.patch [RHEL-143785] - Resolves: RHEL-79118 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled [rhel10]) - Resolves: RHEL-143785 (backport support for GSO over UDP tunnel offload) - kvm-fix-pc_rhel_10_2_compat_len.patch [RHEL-126707] - kvm-q35-increase-default-tseg-size.patch [RHEL-126707] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-139028] - kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch [RHEL-111853] - Resolves: RHEL-126707 ([qemu, rhel-10] increase default TSEG size) - Resolves: RHEL-139028 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-10.2]) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-108142] - Resolves: RHEL-108142 (QEMU crashes when stopping source VM during live migration) - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-134212] - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-110003] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-110003] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-110003] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-110003] - kvm-rh-configs-enable-CONFIG_TDX-for-x86_64.patch [RHEL-111853] - Resolves: RHEL-134212 ([RHEL10.2] L1VH qemu downstream initial merge RHEL10.2) - Resolves: RHEL-110003 (Expose block limits of block nodes in QMP and qemu-img) - Resolves: RHEL-111853 ([Intel 10.0 FEAT] [SPR] TDX: Virt-QEMU: QEMU Support [rhel-10]) - kvm-block-backend-Fix-race-when-resuming-queued-requests.patch [RHEL-129540] - kvm-file-posix-Handle-suspended-dm-multipath-better-for-.patch [RHEL-121543] - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-134212] - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-134212] - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-134212] - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-134212] - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-134212] - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-134212] - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-134212] - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-134212] - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-134212] - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-134212] - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-134212] - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-134212] - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-134212] - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-134212] - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-134212] - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-134212] - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-134212] - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-134212] - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-134212] - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-134212] - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-134212] - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-134212] - kvm-docs-Add-mshv-to-documentation.patch [RHEL-134212] - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-134212] - kvm-accel-mshv-initialize-thread-name.patch [RHEL-134212] - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-134212] - Resolves: RHEL-129540 (Assertion failure on drain with iothread and I/O load) - Resolves: RHEL-121543 (The VM hit io error when do S3-PR integration on the pass-through failover multipath device) - Resolves: RHEL-134212 ([RHEL10.2] L1VH qemu downstream initial merge RHEL10.2) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2257313 - qpdf-11.8.0 is available - 2255755 - qpdf-11.7.0 is available - 2254778 - remove the tests which fail with zlib-ng-compat for now - 2253901 - qpdf-11.6.4 is available - 2244319 - qpdf-11.6.3 is available - 2242670 - qpdf-11.6.2 is available - Introduce qt6-filesystem package Resolves: RHEL-50034 - Bump release for June 2024 mass rebuild - %qt6_install_tests: also install source files Resolves: RHEL-35968 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-32950 Resolves: RHEL-27845 - Adjust qt6_fix_tests macro to handle more cases Resolves: RHEL-28239 - Replace patchelf with chrpath Resolves: RHEL-28239 - Add macros to build and fix Qt unit tests Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78529 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31145 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - Rebuild (broken buildroot) Resolves: RHEL-78530 - 6.9.1 Resolves: RHEL-78530 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31146 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Fix out-of-bounds read in QTextCodec::codecForName() (CVE-2026-9499) Resolves: RHEL-247204 - 6.10.1 Resolves: RHEL-109197 - Rebuild (broken buildroot) Resolves: RHEL-78530 - 6.9.1 Resolves: RHEL-78530 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Disable tests for i686 architecture - 6.10.1 Resolves: RHEL-109197 - QSsl: add support for ML-DSA signature algorithm Resolves: RHEL-97008 - 6.9.1 Resolves: RHEL-78531 - Fix emoji rendering issue Resolves: RHEL-76300 - Backport additional fixes for emoji support Resolves: RHEL-4218 - Sync with Fedora: - fix directory ownership - install cmake modules for plugins - depend on pkgconfig(egl) rather than mesa-libEGL-devel Resolves: RHEL-73681 - Backport additional fixes for emoji support Resolves: RHEL-4218 - Move libcupsprintersupport back to -gui as it depends on gui libs Resolves: RHEL-53982 - Move all mkspecs to -devel Resolves: RHEL-53982 - Move more stuff into -private-devel Resolves: RHEL-53982 - Do not install ExamplesAssetDownloader Resolves: RHEL-53982 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78532 - Rebuild (broken buildroot) Resolves: RHEL-78532 - 6.9.1 Resolves: RHEL-78532 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78533 - Rebuild (broken buildroot) Resolves: RHEL-78533 - 6.9.1 Resolves: RHEL-78533 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Rebuild (broken buildroot) Resolves: RHEL-78534 - 6.9.1 Resolves: RHEL-78534 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31150 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - Backport - CMake: Do not automatically link against Qt6::QmlPrivate Resolves: RHEL-78535 - 6.9.1 Resolves: RHEL-78535 - Drop runtime dependency on qt6-qtbase-private-devel Resolves: RHEL-77748 - Install CMake modules for plugins Resolves: RHEL-73682 - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0 Workaround for rhbz#2330219 Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Do not own /usr/lib[64]/qml directory Resolves: RHEL-50036 - Bump release for June 2024 mass rebuild - VectorImage: sanitize source string used in output (CVE-2025-14576) Resolves: RHEL-173494 - 6.10.1 Resolves: RHEL-109197 - Backport - CMake: Do not automatically link against Qt6::QmlPrivate Resolves: RHEL-78535 - 6.9.1 Resolves: RHEL-78535 - Drop runtime dependency on qt6-qtbase-private-devel Resolves: RHEL-77748 - Install CMake modules for plugins Resolves: RHEL-73682 - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0 Workaround for rhbz#2330219 Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Do not own /usr/lib[64]/qml directory Resolves: RHEL-50036 - 6.10.1 Resolves: RHEL-109197 - Rebuild (broken buildroot) Resolves: RHEL-78536 - 6.9.1 Resolves: RHEL-78536 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31152 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78537 - Move Software Bill of Materials from -devel Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31153 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78538 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31154 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolve: RHEL-78539 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31155 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolve: RHEL-78539 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31155 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78540 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - Backport Qt 6.7.1 fix for ABI breakage Resolves: RHEL-33606 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31156 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78541 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31157 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78542 - 6.9.1 Resolves: RHEL-78542 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - Disable tests for i686 architecture - 6.10.1 Resolves: RHEL-109197 - Fix CVE-2025-11277 in bundled assimp library Resolves: RHEL-120979 - 6.9.1 Resolves: RHEL-78543 - Fix directory ownership Resolves: RHEL-74027 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31159 - 6.10.1 Resolves: RHEL-109197 - Rebuild (broken buildroot) Resolves: RHEL-78544 - 6.9.1 Resolves: RHEL-78544 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31160 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78545 - Rebuild (broken buildroot) Resolves: RHEL-78545 - 6.9.1 Resolves: RHEL-78545 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78546 - Rebuild (broken buildroot) Resolves: RHEL-78546 - 6.9.1 Resolves: RHEL-78546 - Fix directory ownership Resolves: RHEL-74029 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78547 - Rebuild (broken buildroot) Resolves: RHEL-78547 - 6.9.1 Resolves: RHEL-78547 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78548 - 6.9.1 Resolves: RHEL-78548 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78549 - Rebuild (broken buildroot) Resolves: RHEL-78549 - 6.9.1 Resolves: RHEL-78549 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78550 - Unbundle glslang Resolves: RHEL-76115 - Add spirv-tools as a dependency to -devel Resolves: RHEL-74028 - Move Software Bill of Materials from -devel Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78551 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - Install source files for examples Resolves: RHEL-27845 Resolves: RHEL-31167 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31167 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - Upstream backport: Don't add outlines to text when there is none Resolves: RHEL-78552 - 6.9.1 Resolves: RHEL-78552 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31168 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuild (LLVM-21) Resolves: RHEL-108338 - 6.10.1 Resolves: RHEL-109197 - Rebuild (LLVM-21) Resolves: RHEL-108338 - 6.9.1 Resolves: RHEL-78553 - Rebuild (LLVM-20) Resolves: RHEL-81776 - Fix directory ownership Resolves: RHEL-74026 - Add versioned deps to -examples Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Fix build against LLVM 19 Resolves: RHEL-64941 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix unit tests (rebuild for qt6-macros) Resolves: RHEL-35968 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78555 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31171 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - Add pointer warp support Resolves: RHEL-78556 - 6.9.1 Resolves: RHEL-78556 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31172 Resolves: RHEL-33724 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - Add pointer warp support Resolves: RHEL-78556 - 6.9.1 Resolves: RHEL-78556 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31172 Resolves: RHEL-33724 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - Add the missing linking of CorePrivate to WebChannelQuick module Resolves: RHEL-78557 - Re-enable tests Resolves: RHEL-78557 - 6.9.1 Resolves: RHEL-78557 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78558 - 6.9.1 Resolves: RHEL-78558 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Bump release for June 2024 mass rebuild - Bump and rebuild package (for riscv64) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add upstream patches for improved gcc 14 and C++20 support - SPDX migration - Add BSD license that is used by stdint.h and inttypes.h - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Do not force C++11: gtest 1.13.0 requires at least C++14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Bump and rebuild package (for riscv64) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add upstream patches for improved gcc 14 and C++20 support - SPDX migration - Add BSD license that is used by stdint.h and inttypes.h - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Do not force C++11: gtest 1.13.0 requires at least C++14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix issues identified by OpenScanHub Resolves: RHEL-44656 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to readline-8.2 patchlevel 10 Resolves: #2259635 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - add renew command Resolves: RHEL-117645 - Fixes for RHEL SAST Automation Resolves: RHEL-44992 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix ccache handling for leave operation Resolves: jira#SSSD-6420 - improve sssd package handling due to removed sssd meta package Resolves: rhbz#2255725 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - allow multiple names and _srv_ ad_server option Resolves: jira#SSSD-6077 - migrated to SPDX license - fix gating.yaml by generalizing rhel product version string - add gating.yaml copied from c9s branch - import latest fedora sources - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Upstream 7.2.4 release - Upstream 7.2.3 release - Upstream 7.2.2 release - set jemalloc page size #2240293 - Upstream 7.2.1 release - Upstream 7.2 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Upstream 7.2.4 release - Upstream 7.2.3 release - Upstream 7.2.2 release - set jemalloc page size #2240293 - Upstream 7.2.1 release - Upstream 7.2 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update License to SPDX expression - Fix building with cmocka >= 1.1.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to version 1.1.8 o https://gitlab.com/cwrap/resolv_wrapper/-/blob/resolv_wrapper-1.1.8/CHANGELOG - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation) Resolves: RHEL-213749 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Initial version. - Backport https://github.com/coreos/rpm-ostree/pull/5558 - Release 2026.1 - Release 2025.12 - Rebase to 2025.11 - Release 2025.10 - Release 2025.9 - Release 2025.8 - Backport: https://github.com/coreos/rpm-ostree/pull/5351 - Release 2025.7 - backport: https://github.com/coreos/rpm-ostree/pull/5322 https://github.com/coreos/rpm-ostree/pull/5339 which pairs with the previous backport: https://github.com/coreos/rpm-ostree/pull/5341 - Backport: https://github.com/coreos/rpm-ostree/pull/5575 - Rebuild for RHEL 10.2 - Backport https://github.com/coreos/rpm-ostree/pull/5569 - Backport https://github.com/coreos/rpm-ostree/pull/5558 - Release 2026.1 - Release 2025.12 - Rebase to 2025.11 - Release 2025.10 - Release 2025.9 - Release 2025.8 - Backport https://github.com/coreos/rpm-ostree/pull/5620 - spec: new upstream version 2026.2 - Backport: https://github.com/coreos/rpm-ostree/pull/5575 - Rebuild for RHEL 10.2 - Backport https://github.com/coreos/rpm-ostree/pull/5569 - Backport https://github.com/coreos/rpm-ostree/pull/5558 - Release 2026.1 - Release 2025.12 - Rebase to 2025.11 - Release 2025.10 - Backport https://github.com/coreos/rpm-ostree/pull/5633 - Rebase rpm-ostree to 2026.3 - Backport https://github.com/coreos/rpm-ostree/pull/5620 - spec: new upstream version 2026.2 - Backport: https://github.com/coreos/rpm-ostree/pull/5575 - Rebuild for RHEL 10.2 - Backport https://github.com/coreos/rpm-ostree/pull/5569 - Backport https://github.com/coreos/rpm-ostree/pull/5558 - Release 2026.1 - Release 2025.12 - Fix: Treat x86_64_v2 as x86_64 in architecture checks - Fix key import API to return NOTTRUSTED for disabled algorithms (RHEL-112394) - Ignore signatures made by unknown or disabled algorithms (RHEL-112394) - Enable NSS-based user and group lookups again (RHEL-118365) - Fix ignored password field if empty in passwd/group file (RHEL-118365) - Fix pre/post/meta/etc. qualifiers for weak dependencies (RHEL-101936) - Fix redundant rpmdb-migrate.service runs (RHEL-96510) - Fix rpmsign(8) man page (RHEL-109221) - Additional PQC-related fixes (RHEL-109221) - Add support for multiple OpenPGP signatures per package (RHEL-100571) - Add support for OpenPGP v6 signature pre-salting (RHEL-100571) - Add support for PQC algorithms from RFC-9580 (RHEL-100571) - Add --list and --erase commands to rpmkeys(8) (RHEL-105421) - Fix regression on dynamic subpackage RPMTAG_SOURCERPM missing (RHEL-102023) - Bump release for another rebuild - Fix regression on subpackage debuginfo RPMTAG_SOURCERPM missing (RHEL-87383) - Add support for spec local file attributes and generators (RHEL-84057) - Ensure binary and source headers are identified as such (RHEL-87383) - AlmaLinux change: Add AlmaLinux OS change identifier - Generate BuildRequires for extras, drop unused click-plugins dependency - On RHEL, only build the minimal package - Make sure only one libgit2 package is BuildRequired during the build - Add bundled() provides for bundled self and rpmautospec-core - Drop pyproject_macros conditional - Pin libgit2 to soname version tested during build - Update to 0.8.1 - Stop trying to Require libraries with %_isa - Add missing flags to /usr/bin/rpmautospec shebang - AlmaLinux change: Reset the AlmaLinux release counter when the upstream release number is bumped - AlmaLinux change: Keep the counter in the uncommitted-changes preview - AlmaLinux change: Add tests for the AlmaLinux release counter - AlmaLinux change: Add AlmaLinux OS change identifier - Generate BuildRequires for extras, drop unused click-plugins dependency - On RHEL, only build the minimal package - Make sure only one libgit2 package is BuildRequired during the build - Add bundled() provides for bundled self and rpmautospec-core - Drop pyproject_macros conditional - Pin libgit2 to soname version tested during build - Update to 0.8.1 - Stop trying to Require libraries with %_isa - Bump release for June 2024 mass rebuild - Filter out python-missing-require warnings, Fedora's style of Python requirements is not supported - Resolves: rhbz#2260169 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - reset checks after each package, thanks to Daniel García Moreno - Migrate patches to pyproject.toml (rhbz#1899279) - update to 2.5.0 - Disable ErlangCheck by default in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Limit deps and don't ship Fedora config in RHEL builds - AlmaLinux changes: Set x86_64 arch as exchangeable to x86_64_v2 - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for June 2024 mass rebuild - Stricten dependencies between libsolv subpackages (RHEL-38831) - Configure gating - Set x86_64 arch as exchangeable to x86_64_v2 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178270) - Cope with integer overflow in data size arithmetics in repo_add_solv() (CVE-2026-9149) (RHEL-178267) - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository (CVE-2026-9150) (RHEL-178263) - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Apply the upstream PR to support ruby 3.3 Logger - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - improve ruby-2.5 compatibility (epel8) - update to asciidoctor 2.0.20 (rhbz#2208089) - update to asciidoctor 2.0.19 (rhbz#2208089) - fixes for ruby-3.2.x and rouge-4.1.0 (rhbz#2171711) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Apply the upstream PR to support ruby 3.3 Logger - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - improve ruby-2.5 compatibility (epel8) - update to asciidoctor 2.0.20 (rhbz#2208089) - update to asciidoctor 2.0.19 (rhbz#2208089) - fixes for ruby-3.2.x and rouge-4.1.0 (rhbz#2171711) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Skip one test failing with texlive 2022, due to perhaps font issue - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Skip one test failing with texlive 2022, due to perhaps font issue - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Make rubygem-minizip testsuite dependency optional, drop on RHEL (Patch by Jun Aruga <jaruga@redhat.com>) - 1.16.4 - 1.16.3 - 1.16.2 - 1.16.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - 1.16.0 - 1.15.5 - Backport upstream patch for libxml2 2.12.0 error handling change - Bump release for June 2024 mass rebuild - Make rubygem-minizip testsuite dependency optional, drop on RHEL (Patch by Jun Aruga <jaruga@redhat.com>) - 1.16.4 - 1.16.3 - 1.16.2 - 1.16.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - 1.16.0 - 1.15.5 - Backport upstream patch for libxml2 2.12.0 error handling change - Modify RPM verification of ssleay.cnf Related: RHEL-113443 - Fix bogus 'sscg' arguments Related: RHEL-113443 - Update to openwsman-2.8.1 Resolves: RHEL-99191 - Update OpenSSL certificates set up Resolves: RHEL-113443 - Support added for post-quantum cryptography Resolves: RHEL-93091 - Remove deprecated path from systemd service file Resolves: RHEL-101169 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update license tags in subpackages to SPDX format - Modify RPM verification of ssleay.cnf Related: RHEL-113443 - Fix bogus 'sscg' arguments Related: RHEL-113443 - Update to openwsman-2.8.1 Resolves: RHEL-99191 - Update OpenSSL certificates set up Resolves: RHEL-113443 - Support added for post-quantum cryptography Resolves: RHEL-93091 - Remove deprecated path from systemd service file Resolves: RHEL-101169 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update license tags in subpackages to SPDX format - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to Ronn-NG 0.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix FTBFS due to Ruby 3.1 / Psych 4.0 test incompatibility. Resolves: rhbz#2113704 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to Ronn-NG 0.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix FTBFS due to Ruby 3.1 / Psych 4.0 test incompatibility. Resolves: rhbz#2113704 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 4.2.0 - 4.1.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 4.1.0 - Execute spec test provided by the upstream - Backport upstream patch for ruby32 regex issue with hash character - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 4.0.1 - 4.0.0 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 4.2.0 - 4.1.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 4.1.0 - Execute spec test provided by the upstream - Backport upstream patch for ruby32 regex issue with hash character - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 4.0.1 - 4.0.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix one failing test related to thread local variable - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 3.12.2 - Disable unwanted dependencies in RHEL builds - 3.12.1 - Disable GC related test, with the advice from ruby upstream - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Remove unneeded conditionals for new MiniTest support - Support MiniTest 5.19+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 3.12.3 - Disable unwanted dependencies in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 3.12.6 - 3.12.5 - 3.12.4 - Disable unwanted dependencies in RHEL builds - 3.12.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 3.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Backport upstrem patch for pending broken test with ruby >= 3.1.3 - Pull upstream patch (under review) for ruby filer deadlock treatment - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rebase to new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to sanlock-3.8.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - Version 3.4.1: https://github.com/sass/sassc/releases/tag/3.4.1 - Version 3.4.0: https://github.com/sass/sassc/releases/tag/3.4.0 - initial package - Bump release for June 2024 mass rebuild - Rebuild - Update to 0.43 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19) - Update to 0.42 - Resolves: rhbz#2168223 - Update to 0.41 - Resolves: rhbz#2168223 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuild - Update to 0.43 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19) - Update to 0.42 - Resolves: rhbz#2168223 - Update to 0.41 - Resolves: rhbz#2168223 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for rebuild against pacemaker-3.0.0-rc1 package Resolves: RHEL-68410 Resolves: RHEL-67387 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - rebase to upstream v1.5.2 - convert license naming to SPDX - make static analysis happy with a few checks & rearanges with dynamic-memory-management - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add support for Image Mode Resolves: RHEL-132484 - Disable test subpackage - Bump release for rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix tmpfiles path - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Add systemd-units to BR (fixes FTBFS) Resolves: #2171724 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix tmpfiles path - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Add systemd-units to BR (fixes FTBFS) Resolves: #2171724 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix tmpfiles path - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Add systemd-units to BR (fixes FTBFS) Resolves: #2171724 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix tmpfiles path - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Add systemd-units to BR (fixes FTBFS) Resolves: #2171724 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove openssl engine support on EL10 - Add missing SPDX identifiers to license field - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - fix wchar_t usage in sbvarsign (fixes rhbz#2310759) - Fix building with gnu-efi 3.0.18 - Fix building on Fedora 41+ due to OpenSSL engine deprecation - Fix building on aarch64, need to use non-TEST_BINARY_FORMAT codepath like x86_64 - FIxes: RHBZ#2301267 - convert license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 0.9.5 (#2179697) - drop obsolete patches - Use x86_64 as target for x86_64_v2 arch - Rebuild for Konflux (Resolves: RHEL-84822) - rebuilt - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Enable riscv64 - Link in build configuration for i686 to use Fedora build flags - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Set build_type_safety_c to 0 (#2187168) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.32.50 - Backport fixes from upstream + Correctly handle SDL environment variables + Fix to avoid over optimizing away internal strlen Resolves: RHEL-77078 Initial commit on c10s Resolves: RHEL-77078 - Remove yz from manual test name - Initial commit of secvarctl in c10s - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t Resolves: RHEL-193860 - Label /run/coreos with coreos_installer_var_run_t Resolves: RHEL-193859 - Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file() Resolves: RHEL-193859 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Add the rpm_signal() interface Related: RHEL-107589 - Allow tuned_t use its private tmpfs files Related: RHEL-107589 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-93731 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-116041 - Confine redfish_finder - host api discovery service Resolves: RHEL-50299 - Update policy for dhcpc_hook_t Resolves: RHEL-113937 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113937 - Allow systemd to map files under /sys Resolves: RHEL-132638 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t Resolves: RHEL-193860 - Label /run/coreos with coreos_installer_var_run_t Resolves: RHEL-193859 - Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file() Resolves: RHEL-193859 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Add the rpm_signal() interface Related: RHEL-107589 - Allow tuned_t use its private tmpfs files Related: RHEL-107589 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-93731 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-116041 - Confine redfish_finder - host api discovery service Resolves: RHEL-50299 - Update policy for dhcpc_hook_t Resolves: RHEL-113937 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113937 - Allow systemd to map files under /sys Resolves: RHEL-132638 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: switch to HPND license identifier - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - setxkbmap 1.3.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fix pccs npm security flaws - Port to pycryptography and pyasn1 and make keyring optional - Sync specfile changes from Fedora - Drop sgx-mpa dep from sgx-pccs - Add scriptlets for PCCS - Enable pccsadmin everywhere - Update to SGX 2.26 / DCAP 1.23, adding PCCS service - Trigger udev to set perms on /dev/sgx_provision - Temporarily disable automatic tier1 gating - Adapt qgs.service for SELinux policy and sock perms - Fix pccs npm security flaws - Port to pycryptography and pyasn1 and make keyring optional - Sync specfile changes from Fedora - Drop sgx-mpa dep from sgx-pccs - Add scriptlets for PCCS - Enable pccsadmin everywhere - Update to SGX 2.26 / DCAP 1.23, adding PCCS service - Trigger udev to set perms on /dev/sgx_provision - Temporarily disable automatic tier1 gating - Adapt qgs.service for SELinux policy and sock perms - Fix pccs npm security flaws - Port to pycryptography and pyasn1 and make keyring optional - Sync specfile changes from Fedora - Drop sgx-mpa dep from sgx-pccs - Add scriptlets for PCCS - Enable pccsadmin everywhere - Update to SGX 2.26 / DCAP 1.23, adding PCCS service - Trigger udev to set perms on /dev/sgx_provision - Temporarily disable automatic tier1 gating - Adapt qgs.service for SELinux policy and sock perms - Fix pccs npm security flaws - Port to pycryptography and pyasn1 and make keyring optional - Sync specfile changes from Fedora - Drop sgx-mpa dep from sgx-pccs - Add scriptlets for PCCS - Enable pccsadmin everywhere - Update to SGX 2.26 / DCAP 1.23, adding PCCS service - Trigger udev to set perms on /dev/sgx_provision - Temporarily disable automatic tier1 gating - Adapt qgs.service for SELinux policy and sock perms - Fix pccs npm security flaws - Port to pycryptography and pyasn1 and make keyring optional - Sync specfile changes from Fedora - Drop sgx-mpa dep from sgx-pccs - Add scriptlets for PCCS - Enable pccsadmin everywhere - Update to SGX 2.26 / DCAP 1.23, adding PCCS service - Trigger udev to set perms on /dev/sgx_provision - Temporarily disable automatic tier1 gating - Adapt qgs.service for SELinux policy and sock perms - Fix pccs npm security flaws - Port to pycryptography and pyasn1 and make keyring optional - Sync specfile changes from Fedora - Drop sgx-mpa dep from sgx-pccs - Add scriptlets for PCCS - Enable pccsadmin everywhere - Update to SGX 2.26 / DCAP 1.23, adding PCCS service - Trigger udev to set perms on /dev/sgx_provision - Temporarily disable automatic tier1 gating - Adapt qgs.service for SELinux policy and sock perms - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Update to latest upstream release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use SPDX values for License fields in RPM spec file. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Resolves: RHEL-69773, Update "Padauk Book" font priority to 66 - Update CI files - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Convert to new fonts packaging guidelines - Migrate to SPDX license expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - fix issues found by static analysis (RHEL-36476) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - disable pcre module (#2128372) - convert license tag to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add BuildRequires on systemd-rpm-macros Resolves: RHEL-88182 - Use systemd-sysusers Resolves: RHEL-4901 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release due to beta release build issues. Resolves: RHEL-33748 - Bump release for exception phase. Resolves: RHEL-33748 - Bump release for rebuild. Related: RHEL-33748 - Fix initialization of random number generator. Related: RHEL-33748 - Disable usage of OpenSSL engines when providers are available. Resolves: RHEL-33748 - Bump release for June 2024 mass rebuild - Prevent access to global C++ variables once they destroyed - Patch from Neil Horman (OpenSSL) - Update to 4.10.2-2 Resolves: RHEL-152468 - Update to 4.10.2-1 Resolves: RHEL-142629 - Update to 4.10.1-2 Resolves: RHEL-121464 - Update to 4.10.1-1 Resolves: RHEL-121464 - Update to 4.10.0-4 Resolves: RHEL-113793 - Update to 4.10.0-3 Resolves: RHEL-113793 - Update to 4.10.0-2 Resolves: RHEL-113793 - Update to 4.10.0 Resolves: RHEL-110504 Resolves: RHEL-110505 - Update to 4.9.2 Resolves: RHEL-101721 Resolves: RHEL-101722 - Update to 4.9.1-2 in RHEL 10 Resolves: RHEL-86667 Resolves: RHEL-86651 - Update 4.11.0-1 Resolves: RHEL-157821 - Update to 4.10.2-2 Resolves: RHEL-152468 - Update to 4.10.2-1 Resolves: RHEL-142629 - Update to 4.10.1-2 Resolves: RHEL-121464 - Update to 4.10.1-1 Resolves: RHEL-121464 - Update to 4.10.0-4 Resolves: RHEL-113793 - Update to 4.10.0-3 Resolves: RHEL-113793 - Update to 4.10.0-2 Resolves: RHEL-113793 - Update to 4.10.0 Resolves: RHEL-110504 Resolves: RHEL-110505 - Update to 4.9.2 Resolves: RHEL-101721 Resolves: RHEL-101722 - Update to 4.11.2-4 - Update to 4.11.2-3 - Update to 4.11.2-2 - Update 4.11.2-1 - Update 4.11.0-1 Resolves: RHEL-157812 - Update to 4.10.2-2 Resolves: RHEL-152468 - Update to 4.10.2-1 Resolves: RHEL-142629 - Update to 4.10.1-2 Resolves: RHEL-121464 - Update to 4.10.1-1 Resolves: RHEL-121464 - Update to 4.10.0-4 Resolves: RHEL-113793 - Use x86_64 as target for x86_64_v2 arch - Rebuild for Konflux (Resolves: RHEL-84822) - rebuilt - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Enable riscv64 - Link in build configuration for i686 to use Fedora build flags - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Set build_type_safety_c to 0 (#2187168) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add licenses to fully conform with SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Change the License tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Bump release for June 2024 mass rebuild - Updated to version 3.45.1 (https://sqlite.org/releaselog/3_45_1.html) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html) - List versioned soname in files, preventing unnoticed soname bumps - Disable func4 tests for i686 arch due to failing float<->int conversions - Updated to version 3.44.2 (https://sqlite.org/releaselog/3_44_2.html) - Fixes CVE-2026-11822 - Fixes CVE-2026-11824 - Resolves: RHEL-218240 - Resolves: RHEL-218275 - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Bump release for June 2024 mass rebuild - Updated to version 3.45.1 (https://sqlite.org/releaselog/3_45_1.html) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html) - List versioned soname in files, preventing unnoticed soname bumps - Disable func4 tests for i686 arch due to failing float<->int conversions - Updated to version 3.44.2 (https://sqlite.org/releaselog/3_44_2.html) - Fixes CVE-2026-11822 - Fixes CVE-2026-11824 - Resolves: RHEL-218240 - Resolves: RHEL-218275 - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Bump release for June 2024 mass rebuild - Updated to version 3.45.1 (https://sqlite.org/releaselog/3_45_1.html) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html) - List versioned soname in files, preventing unnoticed soname bumps - Disable func4 tests for i686 arch due to failing float<->int conversions - Updated to version 3.44.2 (https://sqlite.org/releaselog/3_44_2.html) - Fixes CVE-2026-11822 - Fixes CVE-2026-11824 - Resolves: RHEL-218240 - Resolves: RHEL-218275 - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Bump release for June 2024 mass rebuild - Updated to version 3.45.1 (https://sqlite.org/releaselog/3_45_1.html) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html) - List versioned soname in files, preventing unnoticed soname bumps - Disable func4 tests for i686 arch due to failing float<->int conversions - Updated to version 3.44.2 (https://sqlite.org/releaselog/3_44_2.html) - Fixes CVE-2026-11822 - Fixes CVE-2026-11824 - Resolves: RHEL-218240 - Resolves: RHEL-218275 - Fix CVE-2025-6965 - Resolves: RHEL-103827 - Fix for CVE-2025-3277 - Resolves: RHEL-87295 - Enabled sqlite-session feature - Resolves: RHEL-77326 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.46.1 - https://www.sqlite.org/releaselog/3_46_1.html - Use x86_64 as target for x86_64_v2 arch - Rebuild for Konflux (Resolves: RHEL-84822) - rebuilt - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Enable riscv64 - Link in build configuration for i686 to use Fedora build flags - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Set build_type_safety_c to 0 (#2187168) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update License field to SPDX - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix building with gcc 14 - incompatible-pointer-types warnings became errors, but they've been present for a long time and posed no threat, thus revert the behaviour - Resolves: rhbz#2259155 - Fix testing of binary patch - Resolves: rhbz#2255746 - rebase to version 1.14.3 (#2256062) - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - fix mod_authz_svn, mod_dontdothat (#2250182) - restore plaintext password storage by default (per upstream) - restrict symbols exposed by DSOs built for httpd - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix building with gcc 14 - incompatible-pointer-types warnings became errors, but they've been present for a long time and posed no threat, thus revert the behaviour - Resolves: rhbz#2259155 - Fix testing of binary patch - Resolves: rhbz#2255746 - rebase to version 1.14.3 (#2256062) - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - fix mod_authz_svn, mod_dontdothat (#2250182) - restore plaintext password storage by default (per upstream) - restrict symbols exposed by DSOs built for httpd - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix building with gcc 14 - incompatible-pointer-types warnings became errors, but they've been present for a long time and posed no threat, thus revert the behaviour - Resolves: rhbz#2259155 - Fix testing of binary patch - Resolves: rhbz#2255746 - rebase to version 1.14.3 (#2256062) - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - fix mod_authz_svn, mod_dontdothat (#2250182) - restore plaintext password storage by default (per upstream) - restrict symbols exposed by DSOs built for httpd - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix building with gcc 14 - incompatible-pointer-types warnings became errors, but they've been present for a long time and posed no threat, thus revert the behaviour - Resolves: rhbz#2259155 - Fix testing of binary patch - Resolves: rhbz#2255746 - rebase to version 1.14.3 (#2256062) - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - fix mod_authz_svn, mod_dontdothat (#2250182) - restore plaintext password storage by default (per upstream) - restrict symbols exposed by DSOs built for httpd - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Bump release for June 2024 mass rebuild - Enable RHEL gating for sudo - Avoid sendmail build dependency - Rabase to 1.9.15p5 - sudo-1_9_15p5 is available Resolves: rhbz#2248505 - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables Resolves: rhbz#2255569 - Rebase to 1.9.14p3 - sudo-1_9_14p2 is available Resolves: rhbz#2175672 - sudo fails to build with Python 3.12: FAILED: testcase check_example_group_plugin_is_able_to_debug() Resolves: rhbz#2186412 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - migrated to SPDX license - Rebuilt for Python 3.12 - Port configure script to C99 - Fix CVE-2026-82474: execveat(2) intercept/log_subcmds bypass - Resolves: RHEL-212546 - Use canonicalized path if user path contains ".." - Bump release number - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls - Resolves: RHEL-59136 - sudo passes SHELL environment variable twice to the shell being executed [rhel-10] - Resolves: RHEL-128212 - [RFE] request to backport support for regex in sudo [rhel-10] - Resolves: RHEL-112100 - Rebase of sudo to 1.9.17p2 [rhel-10] - Rebase sudo to 1.9.17p2 - Resolves: RHEL-122752 - RHEL 10.1 ERRATUM - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009 - CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022 - Bump release for October 2024 mass rebuild: - CVE-2026-96512 sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-10.2.z] - Fix CVE-2026-82474: execveat(2) intercept/log_subcmds bypass - Resolves: RHEL-212546 - Use canonicalized path if user path contains ".." - Bump release number - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls - Resolves: RHEL-59136 - sudo passes SHELL environment variable twice to the shell being executed [rhel-10] - Resolves: RHEL-128212 - [RFE] request to backport support for regex in sudo [rhel-10] - Resolves: RHEL-112100 - Rebase of sudo to 1.9.17p2 [rhel-10] - Rebase sudo to 1.9.17p2 - Resolves: RHEL-122752 - RHEL 10.1 ERRATUM - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009 - CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022 - Bump release for October 2024 mass rebuild: - Bump release number - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls - Resolves: RHEL-59136 - sudo passes SHELL environment variable twice to the shell being executed [rhel-10] - Resolves: RHEL-128212 - [RFE] request to backport support for regex in sudo [rhel-10] - Resolves: RHEL-112100 - Rebase of sudo to 1.9.17p2 [rhel-10] - Rebase sudo to 1.9.17p2 - Resolves: RHEL-122752 - RHEL 10.1 ERRATUM - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009 - CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022 - Bump release for October 2024 mass rebuild: - RHEL 10.0 ERRATUM - sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true positive(s) Resolves: RHEL-44436 - sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864 - RHEL 10.0 ERRATUM - sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true positive(s) Resolves: RHEL-44436 - sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864 - RHEL 10.0 ERRATUM - sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true positive(s) Resolves: RHEL-44436 - sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864 - Bump release for June 2024 mass rebuild - Bump release for June 2024 mass rebuild - Enable RHEL gating for sudo - Avoid sendmail build dependency - Rabase to 1.9.15p5 - sudo-1_9_15p5 is available Resolves: rhbz#2248505 - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables Resolves: rhbz#2255569 - Rebase to 1.9.14p3 - sudo-1_9_14p2 is available Resolves: rhbz#2175672 - sudo fails to build with Python 3.12: FAILED: testcase check_example_group_plugin_is_able_to_debug() Resolves: rhbz#2186412 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - migrated to SPDX license - Rebuilt for Python 3.12 - Port configure script to C99 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add extra SELinux policies. https://github.com/stefanberger/swtpm/issues/970 Resolves: RHEL-70835 Resolves: RHEL-73809 - Add extra SELinux policies. Related: RHEL-53967 - Fix FTBFS, add gmp-devel Resolves: RHEL-65460 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add extra SELinux policies. Resolves: RHEL-47273 - Update to v0.9.0 release Resolves: RHEL-42590 - Fix SHA-1 algorithm availability Resolves: RHEL-46754 - Bump release for June 2024 mass rebuild - Use tpm2-tss to provide tss account - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Build for i686 again since dependency issue resolved - Don't build tools-pkcs11 for i686 since python-tpm2-pytss is not built for it - Set license to BSD-3-Clause for all packages - Add extra SELinux policies. https://github.com/stefanberger/swtpm/issues/970 Resolves: RHEL-70835 Resolves: RHEL-73809 - Add extra SELinux policies. Related: RHEL-53967 - Fix FTBFS, add gmp-devel Resolves: RHEL-65460 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add extra SELinux policies. Resolves: RHEL-47273 - Update to v0.9.0 release Resolves: RHEL-42590 - Fix SHA-1 algorithm availability Resolves: RHEL-46754 - Bump release for June 2024 mass rebuild - Use tpm2-tss to provide tss account - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Build for i686 again since dependency issue resolved - Don't build tools-pkcs11 for i686 since python-tpm2-pytss is not built for it - Set license to BSD-3-Clause for all packages - Use static syslinux64.exe and syslinux.exe to avoid a difference in the checksum in x86_64_v2 arch - Fix more SAST true findings - Resolves: #RHEL-51170 - Bump release number - Resolves: #RHEL-51170 - Bump version and include previous resolves ticket number on commit message - Resolves: #RHEL-51170 - Fix true positives SAST findings - Resolves: #RHEL-51170 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Build tftpboot and nonlinux on x86_64 - Rewrite Digest::SHA1 to SHA - Bump release for June 2024 mass rebuild - Use static syslinux64.exe and syslinux.exe to avoid a difference in the checksum in x86_64_v2 arch - Fix more SAST true findings - Resolves: #RHEL-51170 - Bump release number - Resolves: #RHEL-51170 - Bump version and include previous resolves ticket number on commit message - Resolves: #RHEL-51170 - Fix true positives SAST findings - Resolves: #RHEL-51170 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Build tftpboot and nonlinux on x86_64 - Rewrite Digest::SHA1 to SHA - Bump release for June 2024 mass rebuild - Use static syslinux64.exe and syslinux.exe to avoid a difference in the checksum in x86_64_v2 arch - Fix more SAST true findings - Resolves: #RHEL-51170 - Bump release number - Resolves: #RHEL-51170 - Bump version and include previous resolves ticket number on commit message - Resolves: #RHEL-51170 - Fix true positives SAST findings - Resolves: #RHEL-51170 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Build tftpboot and nonlinux on x86_64 - Rewrite Digest::SHA1 to SHA - Bump release for June 2024 mass rebuild - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Debrand for AlmaLinux - ci: re-enable bpf-framework option for build and unit test jobs (RHEL-152080) - ci: add bpftool workaround to codeql job too (RHEL-152080) - ci: fix workaround about bpftool for codeql (RHEL-152080) - ci: add bpftool workaround to coverity too (RHEL-152080) - path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-152080) - cgroup: port some code over to path_startswith_full() (RHEL-152080) - path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-152080) - sd-json: fix off-by-one issue when updating parent for array elements (RHEL-152080) - core/cgroup: avoid one unnecessary strjoina() (RHEL-152080) - core: validate input cgroup path more prudently (RHEL-152080) - test-journal-dump: dump the headers of journal files (RHEL-106795) - journal: store counts, not byte sizes, in table size constants (RHEL-106795) - journal: treble field hash table size (RHEL-106795) - nspawn: move uid shift/chown() code into shared/ (RHEL-143036) - user-classification: add new "foreign" UID range (RHEL-143036) - userdb: synthesize stub user records for the foreign UID (RHEL-143036) - dissect: add new --shift command (RHEL-143036) - userdb: optionally parse numeric UIDs/GIDs where a username is expected (RHEL-143036) - userdbd: separate parameter structure of GetMemberships() varlink call from the GetUserRecord() one (RHEL-143036) - userdb: move setting of 'service' varlink parameter into userdb_connect() (RHEL-143036) - user-record: make a NULL UserDBMatch be equivalent to no filtering (RHEL-143036) - sd-varlink: add sd_varlink_get_description() call (RHEL-143036) - user-record: add helper for dispatching a disposition mask (RHEL-143036) - user-record: rename USER_DISPOSITION_MASK_MAX → USER_DISPOSITION_MASK_ALL (RHEL-143036) - user-record: add some helpers for working with UserDBMatch (RHEL-143036) - varlink: add new calls for server-side user record filtering to varlink IDL + to spec (RHEL-143036) - userdb: move UserDBMatch handling from userdbctl into generic userdb code to allow it to be done server side (RHEL-143036) - userdbd: implement server side filtering in the Multiplexer API (RHEL-143036) - homectl: port has_regular_user() + acquire_group_list() to use server-side filtering (RHEL-143036) - update TODO (RHEL-143036) - JSON User/Group records: Add properties for UUIDs (RHEL-143036) - userdb: add support for printing the UUID from user and group records (RHEL-143036) - userdb: add support for looking up users or groups by uuid. (RHEL-143036) - userdbctl: add --uuid filtering option (RHEL-143036) - userdbctl: add missing --uuid= to --help text (RHEL-143036) - userdb: fix typo (RHEL-143036) - man/userdbctl: fixup version info (RHEL-143036) - user-record: add a concept of inverting per-host matching sections in user record (RHEL-143034) - homectl: add interface for controlling storage for negative machine ID matches (RHEL-143034) - logind: also save pidfdid as part of session state, even if we don't parse it (RHEL-53112) - logind: support deserializing session leader through pidfdid (RHEL-53112) - TEST-35-LOGIN: test coldplug without fdstore on kernels with pidfd id (RHEL-53112) - logind: fix potential fd leak in deliver_session_leader_fd_consume() (RHEL-53112) - Revert "coredump: lock down EnterNamespace= mount even more" (RHEL-95219) - coredump: add compat support for SYSTEMD_COREDUMP_ALLOW_NAMESPACE_CHANGE (RHEL-95219) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-125822) - hwdb: Add Accelerometer mount matrix for Irbis TW43 (RHEL-72702) - hwdb: map FN key on TongFang X4SP4NAL laptops (RHEL-72702) - hwdb: update rules (RHEL-72702) - hwdb: update autosuspend rules (RHEL-72702) - Add Razer Cobra mouse to hwdb (RHEL-72702) - hwdb: enable autosuspend for Dell DW5826e WWAN modem (RHEL-72702) - hwdb: sort SDR devices by vendor name (RHEL-72702) - 70-mouse.hwdb: Add Razer Basilisk V3, Asus Cerberus, +2 more (RHEL-72702) - hwdb: run "update-hwdb" (RHEL-72702) - Add Hantek DSO-6022 oscilloscopes and compatible devices (RHEL-72702) - Update 60-sensor.hwdb - Add support for Lenovo Legion Go (RHEL-72702) - hwdb: add Airspy devices (RHEL-72702) - hwdb: add more devices (RHEL-72702) - hwdb: add MiriSDR MSi2500 devices (RHEL-72702) - hwdb: add missing Ettus Research B200 rule (RHEL-72702) - hwdb: add LimeSDR XTRX devices (RHEL-72702) - hwdb: add HydraSDR RFOne (RHEL-72702) - hwdb: add SDRplay devices (RHEL-72702) - hwdb: update (RHEL-72702) - hwdb: fix calibrate rotation sensor for Positivo K116J (#39189) (RHEL-72702) - Add Nulea M501 trackball to hwdb (RHEL-72702) - add comment to 70-mouse.hwdb regarding generic name for Nulea M501 USB dongle (RHEL-72702) - remove extra space from new hwdb.d/70-mouse.hwdb entries to fix failing test (RHEL-72702) - remove bonus line (RHEL-72702) - hwdb: drop trailing whitespace (RHEL-72702) - remove Nulea M501 usb entry from hwdb (RHEL-72702) - test/parse_hwdb: wrap Or inside an And in a Group (RHEL-72702) - rules: extend 60-input-id.rules to allow for bus/vid/pid/name matches (RHEL-72702) - hwdb: don't tag a named Mouse device as pointingstick (RHEL-72702) - hwdb: Add V64x_V65xAU to list of Clevo models where scancode f7+f8 get mapped to touchpad-toggle (RHEL-72702) - hwdb: gpd micropc2 sensor (#39493) (RHEL-72702) - hwdb: add support for the Logitech MX Master 4 (#39490) (RHEL-72702) - hwdb: add entry for Acer Switch One 10 (SW1-011) (#39716) (RHEL-72702) - keymap: Ignore brightness keys on Dell Inspiron 3505 to avoid double events (RHEL-72702) - Update hwdb (RHEL-72702) - hwdb: Add Elecom IST Pro trackball (#39762) (RHEL-72702) - hwdb: Fix keyboard backlight keys on Acer Nitro 5 AN515-58 (#39769) (RHEL-72702) - hwdb: Add alternative mode for Beacn Mic (#39868) (RHEL-72702) - Update hwdb (RHEL-72702) - hwdb: add ProtoArc EM01 NL mouse configuration (RHEL-72702) - hwdb: add Magic Trackpad v2 USB-C (2024) to quirks (#40032) (RHEL-72702) - hwdb: sensor: Remove Lenovo IdeaPad D330 accel mount matrix (RHEL-72702) - Update hwdb (RHEL-72702) - hwdb: update autosuspend rules (RHEL-72702) - hwdb: Add ACCEL_MOUNT_MATRIX for variant of TERRA PAD 1061 (RHEL-72702) - hwdb: sensor: Add HP OmniBook Ultra Flip 14 accel mount matrix (#40076) (RHEL-72702) - hwdb: sensor: Remove Lenovo IdeaPad Duet 3 accel mount matrix (#40075) (RHEL-72702) - hwdb: Fix ACCEL_MOUNT_MATRIX for Lenovo Ideapad MIIX 310-ICR (#40067) (RHEL-72702) - hwdb: fix unstable button triggering on Mipad 2 under GNOME (#40071) (RHEL-72702) - Update hwdb (RHEL-72702) - hwdb: touchpad config for Apple MacbookPro12,1 Early 2015 (RHEL-72702) - Add Lenovo Y50-70 touchpad to 60-evdev.hwdb (RHEL-72702) - quirks: sensor: add info about ACPI accel_matrix (RHEL-72702) - quirks: Re-add D330 accel_matrix as identity one (#40226) (RHEL-72702) - quirks: touchpad: Set Duet 3 bt touchpad internal (RHEL-72702) - hwdb: Add missing scancodes for Lenovo Legion devices (RHEL-72702) - hwdb: Add missing vendor names for older AYANEO devices Adds AYADEVICE and AYA NEO vendor names. Early founders editon and 2021 models used these DMI values instead of AYANEO (RHEL-72702) - hwdb: add matrix for ASUS 2-in-1 T101HA (RHEL-72702) - hwdb: add HP EliteBoard Mic mute key mapping (RHEL-72702) - hwdb: Add GPD Pocket 4 chassis quirk (RHEL-72702) - hwdb: make three more hwdb files parsed by parse_hwdb.py (RHEL-72702) - hwdb: set touchpad resolution for all ThinkPad T49x chassis laptops (RHEL-72702) - hwdb: Update Lenovo Legion Go Models - Different BIOS versions of the Legion Go 2 can init the keyboard device as set 1 (appears as raw set 2) or as set 2 (appears as translated set 2). Add the Legion Go 2 to the Translated list. - While at it, specify the models in a more verbose manner for posterity. (RHEL-72702) - hwdb: Add extended SteelSeries Arctis headset device support (#40479) (RHEL-72702) - hwdb: keyboard: fix typo CAPSLOCK to NUMLOCK (RHEL-72702) - hwdb: keyboard: uppercase apple id (RHEL-72702) - integritysetup: Add support for hmac-sha512 (RHEL-27852) - integritysetup: Add PHMAC algorithm to list of known algorithms (RHEL-27852) - core: increment start limit counter only when we can start the unit (RHEL-115032) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-115032) - test: extend start limit interval (RHEL-115032) - userdbctl: optionally show user/group data from JSON filerather than from system (RHEL-143029) - man: fix typo (RHEL-143029) - test: fix test with -Dnetworkd=false (RHEL-143029) - ci: run apt-get update before running mkosi (RHEL-115001) - add GUID for clock group (RHEL-113051) - tools/check-version-history: avoid DeprecationWarning with newer lxml (RHEL-128767) - man: don't duplicate version in History section (RHEL-128767) - tools: ignore root element explicitly in check-version-history (RHEL-128767) - systemd-logind: Add signal section in man systemd-logind (RHEL-128767) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118216) - timer: rebase last_trigger timestamp if needed (RHEL-118216) - man: fix a missing word (RHEL-120277) - sd_bus_open_user_machine(): Don't shortcut without necessary env (RHEL-129179) - udev: set clock group for PTP and RTC devices (RHEL-113051) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126122) - strv: introduce string_strv_hashmap_remove() (RHEL-126937) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-126937) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-126937) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-126937) - spec: ukify: require python3-zstandard (RHEL-103523) - pam_systemd: honor session class provided via PAM environment (RHEL-109832) - udev/net_id: introduce naming scheme for RHEL-10.2 (RHEL-72813) - udev/net_id: introduce naming scheme for RHEL-9.8 (RHEL-72813) - test: split VM-only subtests from TEST-74-AUX-UTILS to new VM-only test (RHEL-112205) - core/transaction: first drop unmergable jobs for anchor jobs (RHEL-112205) - test: add test case for issue #38765 (RHEL-112205) - strv: add strv_equal_ignore_order() helper (RHEL-109902) - pam: minor coding style tweaks (RHEL-109902) - user-record: add helper that checks if a provided user name matches a record (RHEL-109902) - user-record: add support for alias user names to user record (RHEL-109902) - pam_systemd_home: use right field name in error message (RHEL-109902) - pam_systemd_home: support login with alias names + user names with realms (RHEL-109902) - homed: support user record aliases (RHEL-109902) - homectl: add support for creating users with alias names (RHEL-109902) - test: add test for homed alias and realm user resolution (RHEL-109902) - update TODO (RHEL-109902) - udev: create symlinks for s390 PTP devices (RHEL-120177) - test: build the crashing test binary outside of the test (RHEL-113920) - test: exclude test-stacktrace(-not)?-symbolized from the coredump check (RHEL-113920) - mkosi: install test dependencies for EnterNamespace= test (RHEL-113920) - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135) - coredump: restore compatibility with older patterns (RHEL-104135) - coredump: wrap long lines, fix grammar in comments (RHEL-104135) - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135) - coredump: use %d in kernel core pattern (RHEL-104135) - coredump: also stop forwarding non-dumpable processes (RHEL-104135) - coredump: get rid of a bogus assertion (RHEL-104135) - coredump: add support for new %F PIDFD specifier (RHEL-104135) - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135) - coredump: introduce an enum to wrap dumpable constants (RHEL-104135) - Define helper to call PR_SET_DUMPABLE (RHEL-104135) - coredump: fix 0-passed-as-pointer warning (RHEL-104135) - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-118216) - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-118216) - test: check the next elapse timer timestamp after deserialization (RHEL-118216) - timer: don't run service immediately after restart of a timer (RHEL-118216) - test: store and compare just the property value (RHEL-118216) - Debrand for AlmaLinux - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163873) - nspawn: normalize pivot_root paths (RHEL-163873) - udev: check for invalid chars in various fields received from the kernel (RHEL-163879) - udev: ensure there is space for trailing NUL before calling sprintf (RHEL-163879) - udev: ensure tag parsing stays within bounds (RHEL-163879) - udev: fix review mixup (RHEL-163879) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163879) - udev-builtin-net-id: print cescaped bad attributes (RHEL-163879) - ci: re-enable bpf-framework option for build and unit test jobs (RHEL-152080) - ci: add bpftool workaround to codeql job too (RHEL-152080) - ci: fix workaround about bpftool for codeql (RHEL-152080) - ci: add bpftool workaround to coverity too (RHEL-152080) - path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-152080) - cgroup: port some code over to path_startswith_full() (RHEL-152080) - path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-152080) - sd-json: fix off-by-one issue when updating parent for array elements (RHEL-152080) - core/cgroup: avoid one unnecessary strjoina() (RHEL-152080) - core: validate input cgroup path more prudently (RHEL-152080) - test-journal-dump: dump the headers of journal files (RHEL-106795) - journal: store counts, not byte sizes, in table size constants (RHEL-106795) - journal: treble field hash table size (RHEL-106795) - nspawn: move uid shift/chown() code into shared/ (RHEL-143036) - user-classification: add new "foreign" UID range (RHEL-143036) - userdb: synthesize stub user records for the foreign UID (RHEL-143036) - dissect: add new --shift command (RHEL-143036) - userdb: optionally parse numeric UIDs/GIDs where a username is expected (RHEL-143036) - userdbd: separate parameter structure of GetMemberships() varlink call from the GetUserRecord() one (RHEL-143036) - userdb: move setting of 'service' varlink parameter into userdb_connect() (RHEL-143036) - user-record: make a NULL UserDBMatch be equivalent to no filtering (RHEL-143036) - sd-varlink: add sd_varlink_get_description() call (RHEL-143036) - user-record: add helper for dispatching a disposition mask (RHEL-143036) - user-record: rename USER_DISPOSITION_MASK_MAX → USER_DISPOSITION_MASK_ALL (RHEL-143036) - user-record: add some helpers for working with UserDBMatch (RHEL-143036) - varlink: add new calls for server-side user record filtering to varlink IDL + to spec (RHEL-143036) - userdb: move UserDBMatch handling from userdbctl into generic userdb code to allow it to be done server side (RHEL-143036) - userdbd: implement server side filtering in the Multiplexer API (RHEL-143036) - homectl: port has_regular_user() + acquire_group_list() to use server-side filtering (RHEL-143036) - update TODO (RHEL-143036) - JSON User/Group records: Add properties for UUIDs (RHEL-143036) - userdb: add support for printing the UUID from user and group records (RHEL-143036) - userdb: add support for looking up users or groups by uuid. (RHEL-143036) - userdbctl: add --uuid filtering option (RHEL-143036) - userdbctl: add missing --uuid= to --help text (RHEL-143036) - userdb: fix typo (RHEL-143036) - man/userdbctl: fixup version info (RHEL-143036) - user-record: add a concept of inverting per-host matching sections in user record (RHEL-143034) - homectl: add interface for controlling storage for negative machine ID matches (RHEL-143034) - logind: also save pidfdid as part of session state, even if we don't parse it (RHEL-53112) - logind: support deserializing session leader through pidfdid (RHEL-53112) - TEST-35-LOGIN: test coldplug without fdstore on kernels with pidfd id (RHEL-53112) - logind: fix potential fd leak in deliver_session_leader_fd_consume() (RHEL-53112) - Revert "coredump: lock down EnterNamespace= mount even more" (RHEL-95219) - coredump: add compat support for SYSTEMD_COREDUMP_ALLOW_NAMESPACE_CHANGE (RHEL-95219) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-125822) - hwdb: Add Accelerometer mount matrix for Irbis TW43 (RHEL-72702) - hwdb: map FN key on TongFang X4SP4NAL laptops (RHEL-72702) - hwdb: update rules (RHEL-72702) - hwdb: update autosuspend rules (RHEL-72702) - Add Razer Cobra mouse to hwdb (RHEL-72702) - hwdb: enable autosuspend for Dell DW5826e WWAN modem (RHEL-72702) - hwdb: sort SDR devices by vendor name (RHEL-72702) - 70-mouse.hwdb: Add Razer Basilisk V3, Asus Cerberus, +2 more (RHEL-72702) - hwdb: run "update-hwdb" (RHEL-72702) - Add Hantek DSO-6022 oscilloscopes and compatible devices (RHEL-72702) - Update 60-sensor.hwdb - Add support for Lenovo Legion Go (RHEL-72702) - hwdb: add Airspy devices (RHEL-72702) - hwdb: add more devices (RHEL-72702) - hwdb: add MiriSDR MSi2500 devices (RHEL-72702) - hwdb: add missing Ettus Research B200 rule (RHEL-72702) - hwdb: add LimeSDR XTRX devices (RHEL-72702) - hwdb: add HydraSDR RFOne (RHEL-72702) - hwdb: add SDRplay devices (RHEL-72702) - hwdb: update (RHEL-72702) - hwdb: fix calibrate rotation sensor for Positivo K116J (#39189) (RHEL-72702) - Add Nulea M501 trackball to hwdb (RHEL-72702) - add comment to 70-mouse.hwdb regarding generic name for Nulea M501 USB dongle (RHEL-72702) - remove extra space from new hwdb.d/70-mouse.hwdb entries to fix failing test (RHEL-72702) - remove bonus line (RHEL-72702) - hwdb: drop trailing whitespace (RHEL-72702) - remove Nulea M501 usb entry from hwdb (RHEL-72702) - test/parse_hwdb: wrap Or inside an And in a Group (RHEL-72702) - rules: extend 60-input-id.rules to allow for bus/vid/pid/name matches (RHEL-72702) - hwdb: don't tag a named Mouse device as pointingstick (RHEL-72702) - hwdb: Add V64x_V65xAU to list of Clevo models where scancode f7+f8 get mapped to touchpad-toggle (RHEL-72702) - hwdb: gpd micropc2 sensor (#39493) (RHEL-72702) - hwdb: add support for the Logitech MX Master 4 (#39490) (RHEL-72702) - hwdb: add entry for Acer Switch One 10 (SW1-011) (#39716) (RHEL-72702) - keymap: Ignore brightness keys on Dell Inspiron 3505 to avoid double events (RHEL-72702) - Update hwdb (RHEL-72702) - hwdb: Add Elecom IST Pro trackball (#39762) (RHEL-72702) - hwdb: Fix keyboard backlight keys on Acer Nitro 5 AN515-58 (#39769) (RHEL-72702) - hwdb: Add alternative mode for Beacn Mic (#39868) (RHEL-72702) - Update hwdb (RHEL-72702) - hwdb: add ProtoArc EM01 NL mouse configuration (RHEL-72702) - hwdb: add Magic Trackpad v2 USB-C (2024) to quirks (#40032) (RHEL-72702) - hwdb: sensor: Remove Lenovo IdeaPad D330 accel mount matrix (RHEL-72702) - Update hwdb (RHEL-72702) - hwdb: update autosuspend rules (RHEL-72702) - hwdb: Add ACCEL_MOUNT_MATRIX for variant of TERRA PAD 1061 (RHEL-72702) - hwdb: sensor: Add HP OmniBook Ultra Flip 14 accel mount matrix (#40076) (RHEL-72702) - hwdb: sensor: Remove Lenovo IdeaPad Duet 3 accel mount matrix (#40075) (RHEL-72702) - hwdb: Fix ACCEL_MOUNT_MATRIX for Lenovo Ideapad MIIX 310-ICR (#40067) (RHEL-72702) - hwdb: fix unstable button triggering on Mipad 2 under GNOME (#40071) (RHEL-72702) - Update hwdb (RHEL-72702) - hwdb: touchpad config for Apple MacbookPro12,1 Early 2015 (RHEL-72702) - Add Lenovo Y50-70 touchpad to 60-evdev.hwdb (RHEL-72702) - quirks: sensor: add info about ACPI accel_matrix (RHEL-72702) - quirks: Re-add D330 accel_matrix as identity one (#40226) (RHEL-72702) - quirks: touchpad: Set Duet 3 bt touchpad internal (RHEL-72702) - hwdb: Add missing scancodes for Lenovo Legion devices (RHEL-72702) - hwdb: Add missing vendor names for older AYANEO devices Adds AYADEVICE and AYA NEO vendor names. Early founders editon and 2021 models used these DMI values instead of AYANEO (RHEL-72702) - hwdb: add matrix for ASUS 2-in-1 T101HA (RHEL-72702) - hwdb: add HP EliteBoard Mic mute key mapping (RHEL-72702) - hwdb: Add GPD Pocket 4 chassis quirk (RHEL-72702) - hwdb: make three more hwdb files parsed by parse_hwdb.py (RHEL-72702) - hwdb: set touchpad resolution for all ThinkPad T49x chassis laptops (RHEL-72702) - hwdb: Update Lenovo Legion Go Models - Different BIOS versions of the Legion Go 2 can init the keyboard device as set 1 (appears as raw set 2) or as set 2 (appears as translated set 2). Add the Legion Go 2 to the Translated list. - While at it, specify the models in a more verbose manner for posterity. (RHEL-72702) - hwdb: Add extended SteelSeries Arctis headset device support (#40479) (RHEL-72702) - hwdb: keyboard: fix typo CAPSLOCK to NUMLOCK (RHEL-72702) - hwdb: keyboard: uppercase apple id (RHEL-72702) - integritysetup: Add support for hmac-sha512 (RHEL-27852) - integritysetup: Add PHMAC algorithm to list of known algorithms (RHEL-27852) - core: increment start limit counter only when we can start the unit (RHEL-115032) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-115032) - test: extend start limit interval (RHEL-115032) - userdbctl: optionally show user/group data from JSON filerather than from system (RHEL-143029) - man: fix typo (RHEL-143029) - test: fix test with -Dnetworkd=false (RHEL-143029) - ci: run apt-get update before running mkosi (RHEL-115001) - add GUID for clock group (RHEL-113051) - tools/check-version-history: avoid DeprecationWarning with newer lxml (RHEL-128767) - man: don't duplicate version in History section (RHEL-128767) - tools: ignore root element explicitly in check-version-history (RHEL-128767) - systemd-logind: Add signal section in man systemd-logind (RHEL-128767) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118216) - timer: rebase last_trigger timestamp if needed (RHEL-118216) - man: fix a missing word (RHEL-120277) - sd_bus_open_user_machine(): Don't shortcut without necessary env (RHEL-129179) - udev: set clock group for PTP and RTC devices (RHEL-113051) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126122) - strv: introduce string_strv_hashmap_remove() (RHEL-126937) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-126937) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-126937) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-126937) - spec: ukify: require python3-zstandard (RHEL-103523) - pam_systemd: honor session class provided via PAM environment (RHEL-109832) - udev/net_id: introduce naming scheme for RHEL-10.2 (RHEL-72813) - udev/net_id: introduce naming scheme for RHEL-9.8 (RHEL-72813) - test: split VM-only subtests from TEST-74-AUX-UTILS to new VM-only test (RHEL-112205) - core/transaction: first drop unmergable jobs for anchor jobs (RHEL-112205) - test: add test case for issue #38765 (RHEL-112205) - strv: add strv_equal_ignore_order() helper (RHEL-109902) - pam: minor coding style tweaks (RHEL-109902) - user-record: add helper that checks if a provided user name matches a record (RHEL-109902) - user-record: add support for alias user names to user record (RHEL-109902) - pam_systemd_home: use right field name in error message (RHEL-109902) - pam_systemd_home: support login with alias names + user names with realms (RHEL-109902) - homed: support user record aliases (RHEL-109902) - homectl: add support for creating users with alias names (RHEL-109902) - test: add test for homed alias and realm user resolution (RHEL-109902) - update TODO (RHEL-109902) - udev: create symlinks for s390 PTP devices (RHEL-120177) - test: build the crashing test binary outside of the test (RHEL-113920) - test: exclude test-stacktrace(-not)?-symbolized from the coredump check (RHEL-113920) - mkosi: install test dependencies for EnterNamespace= test (RHEL-113920) - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135) - coredump: restore compatibility with older patterns (RHEL-104135) - coredump: wrap long lines, fix grammar in comments (RHEL-104135) - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135) - coredump: use %d in kernel core pattern (RHEL-104135) - coredump: also stop forwarding non-dumpable processes (RHEL-104135) - coredump: get rid of a bogus assertion (RHEL-104135) - coredump: add support for new %F PIDFD specifier (RHEL-104135) - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135) - coredump: introduce an enum to wrap dumpable constants (RHEL-104135) - Define helper to call PR_SET_DUMPABLE (RHEL-104135) - coredump: fix 0-passed-as-pointer warning (RHEL-104135) - Fix RHEL-132752 - Fix RHEL-132057 - Upstream release, see wiki page below for detailed notes. https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-95272 - RHEL-RHEL-89808: stap-server log owned by root - Upstream release, see wiki page below for detailed notes. https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-78062: supply /usr/bin/dtrace in sdt-devel subrpm too - Upstream release, see wiki page below for detailed notes. - https://sourceware.org/systemtap/wiki/SystemTapReleases - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - RHEL-52491 - Fix RHEL-132752 - Fix RHEL-132057 - Upstream release, see wiki page below for detailed notes. https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-95272 - RHEL-RHEL-89808: stap-server log owned by root - Upstream release, see wiki page below for detailed notes. https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-78062: supply /usr/bin/dtrace in sdt-devel subrpm too - Upstream release, see wiki page below for detailed notes. - https://sourceware.org/systemtap/wiki/SystemTapReleases - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - RHEL-52491 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Dropped ucs-miscfixed-fonts requirement, xorg-x11-fonts-misc is enough Resolves: RHEL-46310 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Added SPDX licenses found by ScanCode - Dropped redundant license tags from subpackages - Migrate group creation to sysusers - Bump release and rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - Fix pccs npm security flaws - Port to pycryptography and pyasn1 and make keyring optional - Sync specfile changes from Fedora - Drop sgx-mpa dep from sgx-pccs - Add scriptlets for PCCS - Enable pccsadmin everywhere - Update to SGX 2.26 / DCAP 1.23, adding PCCS service - Trigger udev to set perms on /dev/sgx_provision - Temporarily disable automatic tier1 gating - Adapt qgs.service for SELinux policy and sock perms - Fix pccs npm security flaws - Port to pycryptography and pyasn1 and make keyring optional - Sync specfile changes from Fedora - Drop sgx-mpa dep from sgx-pccs - Add scriptlets for PCCS - Enable pccsadmin everywhere - Update to SGX 2.26 / DCAP 1.23, adding PCCS service - Trigger udev to set perms on /dev/sgx_provision - Temporarily disable automatic tier1 gating - Adapt qgs.service for SELinux policy and sock perms - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.5.12 bump - Correct a license tag to "(LGPL-2.1-or-later OR CPL-1.0) AND (LGPL-2.1-or-later OR GPL-2.0-or-later OR MPL-2.0)" - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.5.11 bump - Correct a license tag to "(LGPL-2.1-or-later OR CPL-1.0) AND (LGPL-2.1-or-later OR GPL-2.0-or-later OR MPL-2.0 OR MPL-1.1)" - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild (icu) - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.3.4 - Update to 5.3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild (mingw-icu) - Update to 5.3.2 - Resolves: CVE-2026-73066 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - disable Build in parallel due to random build error Related: RHEL-34826 - add missing lua-uni-algos and dependency in texlive-luaotfload Related: RHEL-34826 - texlive should use it's own xpdf based library - fixed rpminspect issues - fixed source urls Related: RHEL-34826 - Resolves: RHEL-34826, rebuilt against new xpdf - Rebuilt for ICU 74 - cleanup deps - remove LPPL-1.3 as it is not recognized by SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C type error in paps 0.6.8. Resolves: rhbz#2256906 - Use fmt in header-only mode in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt due to fmt 10 update. - C99 compatibility fixes for paps 0.6.8 - New upstream release. Resolves: rhbz#2168726 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix C89 compatibility issues (GCC 14 build failure) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove implicit ints and implicit function declarations - Add support for Image Mode Resolves: RHEL-114453 - Support added for post-quantum cryptography Resolves: RHEL-93093 - Update OpenSSL certificates set up Resolves: RHEL-86503 - Remove deprecated path from systemd service file Resolves: RHEL-86502 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add epoch prefix to version-release in requires - Add rpminspect.yaml to adjust configuration for rpminspect run Resolves: RHEL-56884 - Bump release for June 2024 mass rebuild - Add riscv64 support - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for Konflux (Resolves: RHEL-84822) - Rebuild for Konflux - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add tomcat-jakartaee-migration package to RHEL 10 - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix rpminspect pathmigration issue Resolves: RHEL-70711 - Fix rpminspect permissions and capabilities issue Resolves: RHEL-70711 - torque: add basic sanity test for CI gating Resolves: RHEL-70711 - Fix rpminspect issue Resolves: RHEL-70711 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issue - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issue - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fix trace messages (RHEL-80321) - Prevent buffer overflow in update_pid_filters() (RHEL-56731) - Rebase to 3.3.1 and backport further SAST patches (RHEL-40111) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Drop useless mlocate dependency (RHEL-39377) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.2 (#2213350) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Remove lingering kernelshark dependencies - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix parameters for specifying the target user (frostyx@email.cz) - Fix querying RPM files on EPEL7 (frostyx@email.cz) - Use backported lru_cache on EPEL7 (frostyx@email.cz) - Don't hang forever when executed via SSH (frostyx@email.cz) - Don't check if package is installed before listing its files (frostyx@email.cz) - Replace regexes where they are not needed (frostyx@email.cz) - Query all packages at once, its faster than one by one (frostyx@email.cz) - Cache some properties for a massive performance boost (frostyx@email.cz) - Refactor unnecessary condition (frostyx@email.cz) - Fix weird indentation (frostyx@email.cz) - Pass the whole application to the provided_by function, not just its name (frostyx@email.cz) - Stop using deprecated rpm.fi (frostyx@email.cz) - Attempt to fix readthedocs deprecation error (frostyx@email.cz) - More reliable check if /usr/lib/sysimage/dnf/ database should be used (frostyx@email.cz) - Rather create a /run/reboot-required not /var/run/reboot-required (frostyx@email.cz) - Update license to SPDX (frostyx@email.cz) - Update tito releasers (frostyx@email.cz) - Create /var/run/reboot-required file (frostyx@email.cz) - Recommend the correct command for restarting auditd (frostyx@email.cz) - Add python3-setuptools dependency (frostyx@email.cz) - Fix argument passed to print_helper() (ferdnyc@gmail.com) - Add similar software to the readme (frostyx@email.cz) - Update url references to point to tracer.readthedocs.io (dcampano@gmail.com) - Oracle Linux 8 uses dnf, too (suttner@atix.de) - Drop python-setuptools runtime dependency (frostyx@email.cz) - Fix Python DeprecationWarning: invalid escape sequence (jvanderwaa@redhat.com) - Add readthedocs configuration file (frostyx@email.cz) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Synchronize with Fedora Rawhide Resolves: RHEL-102712 - Synchronize with Fedora Rawhide Resolves: RHEL-73815 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73312 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add pkgconfig provides - Add dependency on cmake-rpm-macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Set mingw_env before in run_mingw_make - Set RUSTFLAGS in mingw env - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73822 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73825 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73825 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73826 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release - RHEL-45476 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73826 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release - RHEL-45476 - Update gating.yaml for RHEL10 - Bump release for June 2024 mass rebuild - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Convert to SPDX license. - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Convert to SPDX license. - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream release 1.19.1 - Resolves: RHEL-98259 - Update to upstream release 1.18.1 - Resolves: RHEL-94486 - Enable riscv64 - Fix Unhandled patch file issue Resolves: RHEL-24811 - Update to upstream release 1.17.0 Resolves: RHEL-24811 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for June 2024 mass rebuild - preload: Re-fix time64 redirects for glibc < 2.39.9 - preload: Fix time64 redirect for glibc 2.39.9 - preload: Provide wrappers for functions specific to 64-bit time_t (thanks Steve Langasek) - preload: Fix building with _FILE_OFFSET_BITS (thanks Zixing Liu and Steve Langasek) - Record and restore SELinux context for mocked /dev nodes - preload: wrap fstatfs() and statfs() on musl - Fix build with meson 1.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - preload: Don't read udev cache data from system (thanks Bastien Nocera) - spec: Update License: to SPDX format - Various test fixes - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix race with worker thread accessing $UMOCKDEV_DIR - Disable -Wincompatible-function-pointer-types for clang <!-- generated by eloquent/github-release-action --> <!-- original source: - preload: Wrap __getcwd_chk() - uevent_sender: Fix fd leak in sendmsg_one - Fix gcc -fanalyzer complaints --> <ul> <li>preload: Wrap __getcwd_chk()</li> <li>uevent_sender: Fix fd leak in sendmsg_one</li> <li>Fix gcc -fanalyzer complaints</li> </ul> - Bump release for June 2024 mass rebuild - preload: Re-fix time64 redirects for glibc < 2.39.9 - preload: Fix time64 redirect for glibc 2.39.9 - preload: Provide wrappers for functions specific to 64-bit time_t (thanks Steve Langasek) - preload: Fix building with _FILE_OFFSET_BITS (thanks Zixing Liu and Steve Langasek) - Record and restore SELinux context for mocked /dev nodes - preload: wrap fstatfs() and statfs() on musl - Fix build with meson 1.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - preload: Don't read udev cache data from system (thanks Bastien Nocera) - spec: Update License: to SPDX format - Various test fixes - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix race with worker thread accessing $UMOCKDEV_DIR - Disable -Wincompatible-function-pointer-types for clang <!-- generated by eloquent/github-release-action --> <!-- original source: - preload: Wrap __getcwd_chk() - uevent_sender: Fix fd leak in sendmsg_one - Fix gcc -fanalyzer complaints --> <ul> <li>preload: Wrap __getcwd_chk()</li> <li>uevent_sender: Fix fd leak in sendmsg_one</li> <li>Fix gcc -fanalyzer complaints</li> </ul> - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to Unicode Emoji Data 15.1 (was released on September 12, 2023) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Change license tag from Unicode-TOU to Unicode-DFS-2016 See: https://gitlab.com/fedora/legal/fedora-license-data/-/issues/199 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to Unicode Emoji Data 15.0 (was released on September 13, 2022) - Migrate license tag to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - The resource leak fixes - Update to the upstream version 1.90.10 - Update to the upstream version 1.90.9 - Fix unstable OnBattery status - Update to the upstream version 1.90.8 - Update to 1.90.8 - README and HACKING were renamed to README.md and HACKING.md - Support zsh-completion - Resolve memory leak when connecting/disconnecting and refreshing the battery info. - test: Fix incorrect test script - Bump release for October 2024 mass rebuild: - Update to upstream version 1.90.6 - Update to the upstream version 1.90.6 - Include a fix patch for "incorrect external device battery update" issue. Link: https://gitlab.freedesktop.org/upower/upower/- /commit/7d7bb84fde91bef9ee7eba924cbdfa74639cc4fe - Bump release for June 2024 mass rebuild - Add gating definition for RHEL-10 - RHEL-32340 Update to release 1.90.4 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Restore permission of the log directory Resolves: RHEL-92260 - Rebase to 1.1.4 - selinux: comply with with the "Unify bin and sbin" change Resolves: RHEL-113206 - Restore permissions of the log directory Resolves: RHEL-92260 - Install usbguard-tmpfles.conf Resolves: RHEL-78183 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Disable building for i686 - Update Requires list on selinux subpackage Resolves: RHEL-37322 - Rebase to 1.1.3 - Update usbguard-selinux subpackage - Include usbguard-notifier subpackage Resolves: RHEL-37322 - Disable logging to console - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - use sysuser setting for uuidd - Fix heap buffer overread in setpwnam() [CVE-2025-14104] - libfdisk: fix off-by-one in maximum last sector calculation - mount: improve --all documentation - libblkid: Fix probe_ioctl_tp assigning BLKGETDISKSEQ as physical - libblkid: use snprintf() instead of sprintf() - lscpu: Add NVIDIA Olympus arm64 core - libfdisk: improve collision reporting - libfdisk: (dos) ignore incomplete EBR for non-wholedisk - wall: always use utmp as fallback - lscpu: update table with ARM IDs - coresched: backport new tool to RHEL-10 - agetty: fix stdin conversion to tty name - blkid: allow up to 64k erofs block sizes - more(1): make sure we have data on stderr - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use standard Fedora linker flags (bug #1548666) https://src.fedoraproject.org/rpms/uuid/pull-request/1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - update license tag format (SPDX migration) for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use standard Fedora linker flags (bug #1548666) https://src.fedoraproject.org/rpms/uuid/pull-request/1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - update license tag format (SPDX migration) for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use standard Fedora linker flags (bug #1548666) https://src.fedoraproject.org/rpms/uuid/pull-request/1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - update license tag format (SPDX migration) for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for CRB inclusion Resolves: RHEL-135109 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.26.1 - Fix gating string - add gating.yaml and test plan - Bump release for June 2024 mass rebuild - Fix loading unbundled undici builtin (rhbz#2259320) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 20.11.0 - remove bundled WASM blobs - sitelib is a symlink, not a dir - Fix missing %dir - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 - sources: changed ICU version syntax - Bump release to get correct RHEL build - Filter for nodejs22.fmf in gating plan - Update to 22.22.0 - Unit-tests adjustment - disable internet/test-dgram-membership - Add patch to prevent fips usage segfault - Update to version 22.19.0 - configure.py: use local headers for building native addons when available - spec: fix node binary calls to use versioned binary - CVE-2026-42338 ip-address HTML escaping fix. - Update to version 22.23.1 - De-bundle c-ares, libuv - we waited for c-ares for about 4 months, so added conditional flag in case it falls behind in future again, same for libuv - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 - sources: changed ICU version syntax - Bump release to get correct RHEL build - Filter for nodejs22.fmf in gating plan - Update to 22.22.0 - Unit-tests adjustment - disable internet/test-dgram-membership - Add patch to prevent fips usage segfault - Fix CVE-2026-13149 (npm/brace-expansion) - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar) - CVE-2026-42338 ip-address HTML escaping fix. - Update to version 22.23.1 - De-bundle c-ares, libuv - we waited for c-ares for about 4 months, so added conditional flag in case it falls behind in future again, same for libuv - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 - sources: changed ICU version syntax - Bump release to get correct RHEL build - Filter for nodejs22.fmf in gating plan - Update to 22.22.0 - Fix for CVE-2026-69152 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 (npm/brace-expansion) - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar) - CVE-2026-42338 ip-address HTML escaping fix. - Update to version 22.23.1 - De-bundle c-ares, libuv - we waited for c-ares for about 4 months, so added conditional flag in case it falls behind in future again, same for libuv - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 - sources: changed ICU version syntax - Bump release to get correct RHEL build - Update to version 22.23.2 - Fix for CVE-2026-69152 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 (npm/brace-expansion) - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar) - CVE-2026-42338 ip-address HTML escaping fix. - Update to version 22.23.1 - De-bundle c-ares, libuv - we waited for c-ares for about 4 months, so added conditional flag in case it falls behind in future again, same for libuv - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 - sources: changed ICU version syntax - Fix CVE-2026-19534: Update undici to 6.28.1 - Fix CVE-2026-9496: avoid ReDoS in pacote's addGitSha - Update to version 22.23.2 - Fix for CVE-2026-69152 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 (npm/brace-expansion) - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar) - CVE-2026-42338 ip-address HTML escaping fix. - Update to version 22.23.1 - De-bundle c-ares, libuv - we waited for c-ares for about 4 months, so added conditional flag in case it falls behind in future again, same for libuv - Update bundled nghttp2 to 1.68.1 - Update to version 24.14.1 - Swap definition order for metadata fields - Update to 24.13.0 - makefile: change package manager to RH one - Update to version 24.11.1 - Correct dependency version macros - spec: fix node binary calls to use versioned node-24 binary - test-plan: adjust variables and filter - Update to version 24.6.0 - Update to version 24.18.0 - De-bundle c-ares and libuv - Update bundled nghttp2 to 1.68.1 - Update to version 24.14.1 - Swap definition order for metadata fields - Update to 24.13.0 - makefile: change package manager to RH one - Update to version 24.11.1 - Correct dependency version macros - spec: fix node binary calls to use versioned node-24 binary - Fix CVE-2026-13149 (brace-expansion) - Fix CVE-2026-59873 and CVE-2026-59874 (nodejs-tar) - Update to version 24.18.0 - De-bundle c-ares and libuv - Update bundled nghttp2 to 1.68.1 - Update to version 24.14.1 - Swap definition order for metadata fields - Update to 24.13.0 - makefile: change package manager to RH one - Update to version 24.11.1 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 (brace-expansion) - Fix CVE-2026-13149 (brace-expansion) - Fix CVE-2026-59873 and CVE-2026-59874 (nodejs-tar) - Update to version 24.18.0 - De-bundle c-ares and libuv - Update bundled nghttp2 to 1.68.1 - Update to version 24.14.1 - Swap definition order for metadata fields - Update to 24.13.0 - Update to version 24.19.0 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 (brace-expansion) - Fix CVE-2026-13149 (brace-expansion) - Fix CVE-2026-59873 and CVE-2026-59874 (nodejs-tar) - Update to version 24.18.0 - De-bundle c-ares and libuv - Update bundled nghttp2 to 1.68.1 - Update to version 24.14.1 - Swap definition order for metadata fields - Update to version 24.21.0 - Update to version 24.19.0 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 (brace-expansion) - Fix CVE-2026-13149 (brace-expansion) - Fix CVE-2026-59873 and CVE-2026-59874 (nodejs-tar) - Update to version 24.18.0 - De-bundle c-ares and libuv - Update bundled nghttp2 to 1.68.1 - Update to version 24.14.1 - Rebase to 8.0.11 for CVE-2026-56684 CVE-2026-63639 (CVE-2026-66373 in redis) - Rebase to 8.0.9 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631 - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - fix ImageMode: ensure ownership of /etc/valkey - fix ImageMode: add tmpfiles.d entries for directories below /var - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023 - rebase to 8.0.3 - rebase to 8.0.2 Resolves: RHEL-73273 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - fix ImageMode: ensure ownership of /etc/valkey - fix ImageMode: add tmpfiles.d entries for directories below /var - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023 - rebase to 8.0.3 - rebase to 8.0.2 Resolves: RHEL-73273 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebase to 7.2.6 - merge limit.conf in main service files - drop /etc/sysconfig/valkey - rename compat package - fix working dir - partially enable upstream test suite - Bump release for June 2024 mass rebuild - Rebase to 8.0.9 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631 - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - fix ImageMode: ensure ownership of /etc/valkey - fix ImageMode: add tmpfiles.d entries for directories below /var - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023 - rebase to 8.0.3 - rebase to 8.0.2 Resolves: RHEL-73273 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebase to 7.2.6 - merge limit.conf in main service files - drop /etc/sysconfig/valkey - rename compat package - fix working dir - partially enable upstream test suite - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - ci: Use tmt based test cases - Resolves:RHELMISC-3924 - adding gating configuration - Bump release for June 2024 mass rebuild - Update License field to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Update to virt-v2v-2.10.0-17 - mlcustomize firstboot: be more careful about quoting and create a sentinel file when firstboot completes - Add --no-fstrim option to disable fstrim during conversion - convert: stop using maxmem (xfs_repair -m option) - mldrivers/firmware.ml: ignore CHS geometry error from parted (Veritas/Sun partitions) - docs: show input parameters for -i input methods - docs: -i disk allows multiple disk images - -i disk: allow nbd:// URIs for input disks - Fix binary LUKS keys (read_whole_file, text: and base64: key prefixes) - Windows firstboot: add exit code 250 to skip reboots - smp: use cgroup CPU limits for appliance SMP - Fix location of Windows Vista and Windows 2008 Server R1 drivers - Require libguestfs >= 1:1.58.1-6 (text:/base64 LUKS prefixes) - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Further fixes for QEMU Guest Agent install & VMware Tools removal resolves: RHEL-50563 - Fix installation of QEMU Guest Agent resolves: RHEL-50563 - New upstream development version 2.5.5 resolves: RHEL-46869 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - -i libvirtxml: Add -io nbd-tls-certificates for NBD disks resolves: RHEL-276238 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Update to virt-v2v-2.10.0-17 - mlcustomize firstboot: be more careful about quoting and create a sentinel file when firstboot completes - Add --no-fstrim option to disable fstrim during conversion - convert: stop using maxmem (xfs_repair -m option) - mldrivers/firmware.ml: ignore CHS geometry error from parted (Veritas/Sun partitions) - docs: show input parameters for -i input methods - docs: -i disk allows multiple disk images - -i disk: allow nbd:// URIs for input disks - Fix binary LUKS keys (read_whole_file, text: and base64: key prefixes) - Windows firstboot: add exit code 250 to skip reboots - smp: use cgroup CPU limits for appliance SMP - Fix location of Windows Vista and Windows 2008 Server R1 drivers - Require libguestfs >= 1:1.58.1-6 (text:/base64 LUKS prefixes) - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Further fixes for QEMU Guest Agent install & VMware Tools removal resolves: RHEL-50563 - Fix installation of QEMU Guest Agent resolves: RHEL-50563 - New upstream development version 2.5.5 resolves: RHEL-46869 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - -i libvirtxml: Add -io nbd-tls-certificates for NBD disks resolves: RHEL-276238 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Update to virt-v2v-2.10.0-17 - mlcustomize firstboot: be more careful about quoting and create a sentinel file when firstboot completes - Add --no-fstrim option to disable fstrim during conversion - convert: stop using maxmem (xfs_repair -m option) - mldrivers/firmware.ml: ignore CHS geometry error from parted (Veritas/Sun partitions) - docs: show input parameters for -i input methods - docs: -i disk allows multiple disk images - -i disk: allow nbd:// URIs for input disks - Fix binary LUKS keys (read_whole_file, text: and base64: key prefixes) - Windows firstboot: add exit code 250 to skip reboots - smp: use cgroup CPU limits for appliance SMP - Fix location of Windows Vista and Windows 2008 Server R1 drivers - Require libguestfs >= 1:1.58.1-6 (text:/base64 LUKS prefixes) - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Further fixes for QEMU Guest Agent install & VMware Tools removal resolves: RHEL-50563 - Fix installation of QEMU Guest Agent resolves: RHEL-50563 - New upstream development version 2.5.5 resolves: RHEL-46869 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - -i libvirtxml: Add -io nbd-tls-certificates for NBD disks resolves: RHEL-276238 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Updated to upstream version 1.2 plus latest fixes resolves: RHEL-143145 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - adding gating.yaml configuration - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - New upstream release - Update C++ standard from C++11 to C++14 - Compilation fixes for recent versions of GCC - Small fixes to Finnish grammar checker - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Migrate license tag to SPDX - Rebase to 1.24.0 Resolves: RHEL-107614 - Update to 1.23.1 Resolves: RHEL-86834 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 1.23.0 (RHEL-45197) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New release: 35.11 (bcl) - build(deps): bump github.com/BurntSushi/toml from 1.3.0 to 1.3.1 (49699333+dependabot[bot]) - build(deps): bump github.com/stretchr/testify from 1.8.3 to 1.8.4 (49699333+dependabot[bot]) - CI: Update terraform hash (bcl) - build(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.0 (49699333+dependabot[bot]) - build(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.3 (49699333+dependabot[bot]) - docs: fix typo/formatting in HACKING.md (idiez) - Add release creation documentation (bcl) - wireplumber 0.5.10 Resolves: DESKTOP-1859 - wireplumber 0.5.8 Resolves: RHEL-72787 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - wireplumber 0.5.5 - wireplumber 0.5.4 - wireplumber 0.5.3 - wireplumber 0.5.2 - Backport support for loading external WpConf from disk - wireplumber 0.5.1 - Backport MR #620 to fix issues with bluetooth headsets etc. - Resolves: rhbz#2269343 - wireplumber 0.5.10 Resolves: DESKTOP-1859 - wireplumber 0.5.8 Resolves: RHEL-72787 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - wireplumber 0.5.5 - wireplumber 0.5.4 - wireplumber 0.5.3 - wireplumber 0.5.2 - Backport support for loading external WpConf from disk - wireplumber 0.5.1 - Backport MR #620 to fix issues with bluetooth headsets etc. - Resolves: rhbz#2269343 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Migrated to SPDX license IDs - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - xkbcomp 1.4.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: add SPDX license entries - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - xkbcomp 1.4.6 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.59.02 rhbz#1694044 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - update to 1.51.08 - Remove meson build code, follow upstream build methods - rhbz#2009098 - rhbz#2010890 - Merge PR from yselkowitz to fix meson builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.59.02 rhbz#1694044 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - update to 1.51.08 - Remove meson build code, follow upstream build methods - rhbz#2009098 - rhbz#2010890 - Merge PR from yselkowitz to fix meson builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.59.02 rhbz#1694044 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - update to 1.51.08 - Remove meson build code, follow upstream build methods - rhbz#2009098 - rhbz#2010890 - Merge PR from yselkowitz to fix meson builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.59.02 rhbz#1694044 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - update to 1.51.08 - Remove meson build code, follow upstream build methods - rhbz#2009098 - rhbz#2010890 - Merge PR from yselkowitz to fix meson builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.59.02 rhbz#1694044 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - update to 1.51.08 - Remove meson build code, follow upstream build methods - rhbz#2009098 - rhbz#2010890 - Merge PR from yselkowitz to fix meson builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.59.02 rhbz#1694044 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - update to 1.51.08 - Remove meson build code, follow upstream build methods - rhbz#2009098 - rhbz#2010890 - Merge PR from yselkowitz to fix meson builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: rhbz#2149129 latest upstream release - Resolves: rhbz#2138484 latest upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: rhbz#2149129 latest upstream release - Resolves: rhbz#2138484 latest upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: rhbz#2149129 latest upstream release - Resolves: rhbz#2138484 latest upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: rhbz#2149129 latest upstream release - Resolves: rhbz#2138484 latest upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: rhbz#2149129 latest upstream release - Resolves: rhbz#2138484 latest upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: rhbz#2149129 latest upstream release - Resolves: rhbz#2138484 latest upstream release - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating tests - Resolves: RHEL-46771 Rebase to version 1.2.39 Fix openssl engine dependency Stop building gcrypt and gnutls implementations - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: rhbz#2149129 latest upstream release - Resolves: rhbz#2138484 latest upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: rhbz#2149129 latest upstream release - Resolves: rhbz#2138484 latest upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - xmodmap 1.0.11 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: mark license as SPDX compatible - xf86-input-libinput 1.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - xf86-input-libinput 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: mark license as SPDX compatible - xf86-input-libinput 1.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - xf86-input-libinput 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Fix regression caused by the fix for CVE-2024-31083 - Add gating.yaml - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix compilation error on i686 - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 - CVE fix for: CVE-2023-6377, CVE-2023-6478 - Update with full SPDX license list - Bump release for June 2024 mass rebuild - Fix regression caused by the fix for CVE-2024-31083 - Add gating.yaml - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix compilation error on i686 - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 - CVE fix for: CVE-2023-6377, CVE-2023-6478 - Update with full SPDX license list - Bump release for June 2024 mass rebuild - Fix regression caused by the fix for CVE-2024-31083 - Add gating.yaml - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix compilation error on i686 - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 - CVE fix for: CVE-2023-6377, CVE-2023-6478 - Update with full SPDX license list - Bump release for June 2024 mass rebuild - Fix regression caused by the fix for CVE-2024-31083 - Add gating.yaml - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix compilation error on i686 - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 - CVE fix for: CVE-2023-6377, CVE-2023-6478 - Update with full SPDX license list - Bump release for June 2024 mass rebuild - Fix regression caused by the fix for CVE-2024-31083 - Add gating.yaml - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix compilation error on i686 - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 - CVE fix for: CVE-2023-6377, CVE-2023-6478 - Update with full SPDX license list - Bump release for June 2024 mass rebuild - Fix regression caused by the fix for CVE-2024-31083 - Add gating.yaml - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix compilation error on i686 - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 - CVE fix for: CVE-2023-6377, CVE-2023-6478 - Update with full SPDX license list - Bump release for June 2024 mass rebuild - Fix regression caused by the fix for CVE-2024-31083 - Add gating.yaml - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix compilation error on i686 - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 - CVE fix for: CVE-2023-6377, CVE-2023-6478 - Update with full SPDX license list - Bump release for June 2024 mass rebuild - Fix regression caused by the fix for CVE-2024-31083 - Add gating.yaml - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 - Add util-linux as a dependency of Xvfb - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix compilation error on i686 - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 - CVE fix for: CVE-2023-6377, CVE-2023-6478 - Update with full SPDX license list - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - xorg-x11-xinit 1.4.2 - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - include MATE in Xclients fallback logic (#1517597) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - xorg-x11-xinit 1.4.2 - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - include MATE in Xclients fallback logic (#1517597) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add self-tests and an OSCI harness (RHEL-20173) - Bump release for June 2024 mass rebuild - Initial import from Fedora 40 - Add self-tests and an OSCI harness (RHEL-20173) - Bump release for June 2024 mass rebuild - Initial import from Fedora 40 - Add self-tests and an OSCI harness (RHEL-20173) - Bump release for June 2024 mass rebuild - Initial import from Fedora 40 - Add self-tests and an OSCI harness (RHEL-20173) - Bump release for June 2024 mass rebuild - Initial import from Fedora 40 - Fix: heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115) - Resolves: RHEL-86029 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - finish SPDX license conversion (RHEL-46960) - Update to https://github.com/tukaani-project/xz/releases/tag/v5.6.2 - Resolves: RHEL-43733 - Build package with correct SPDX licence - Bump release for June 2024 mass rebuild - New version 5.4.6 (RHBZ#2260521) - Fix Source URLs. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New version 5.4.5 (RHBZ#2247487) - Mark translations of manuals with %lang() - Fix: a buffer overflow in lzma_index_append() - Add test for the issue above (needs a special build config to actually fail -> does not fail in our environemnt) - Resolves: CVE-2026-34743 - Fix: heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115) - Resolves: RHEL-86029 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Switch to using git for managing patches - Fix potential buffer overread (CVE-2017-16516) - Fix integer overflow leading to heap corruption (CVE-2022-24795) - Fix multiple memory leaks (CVE-2023-33460) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Switch to using git for managing patches - Fix potential buffer overread (CVE-2017-16516) - Fix integer overflow leading to heap corruption (CVE-2022-24795) - Fix multiple memory leaks (CVE-2023-33460) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Initial commit on c10s - Resolves: RHEL-60383 - Bump release - Bump release for rebuild - Update yggdrasil to 0.4.9 - Remove gomodulemode export from spec file - Update yggdrasil to 0.4.8 - Enable tier1 functional gating tests - Update yggdrasil to 0.4.7 - Update yggdrasil to 0.4.6 - Create rhcd.service sym link to yggdrasil.service - Update to 0.4.5 (RHEL-77619) - Rebuild yggdrasil against updated golang - Update yggdrasil to 0.4.9.2 - Update yggdrasil to 0.4.9.1 - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Update yggdrasil to 0.4.9 - Remove gomodulemode export from spec file - Update yggdrasil to 0.4.8 - Rebuild yggdrasil against updated golang - Rebuild yggdrasil against updated golang - Update yggdrasil to 0.4.9.2 - Update yggdrasil to 0.4.9.1 - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Update yggdrasil to 0.4.9 - Remove gomodulemode export from spec file - Update yggdrasil to 0.4.9.2 - Update yggdrasil to 0.4.9.1 - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Update yggdrasil to 0.4.9 - Remove gomodulemode export from spec file - Update yggdrasil to 0.4.8 - Enable tier1 functional gating tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - fix segfault in delerefilelist (rhbz#2245462) - Fix C compatibility issue in the configure script - fix FTBFS caused by texinfo 7.1 - fix build of the PCRE module - port to PCRE 2 (rhbz#1938979) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Make zsh/{tcp,zftp} compatible with full RELRO (rhbz#2212160) - Update the License tag to use SPDX identifiers